GitHub Actions CI/CD Pipeline for Node.js — Test, Build, and Deploy Automatically (2026)

your-app/
├── .github/
│   └── workflows/
│       ├── ci.yml         # runs on every PR
│       └── deploy.yml     # runs on merge to main
├── Dockerfile
├── .dockerignore
├── package.json
└── src/

# Stage 1: Build
FROM node:22-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci
COPY . .
RUN npm run build

# Stage 2: Production image
FROM node:22-alpine AS runner
RUN addgroup -g 1001 -S nodejs && adduser -S nodeapp -u 1001
WORKDIR /app

COPY package*.json ./
RUN npm ci --only=production && npm cache clean --force

COPY --from=builder --chown=nodeapp:nodejs /app/dist ./dist

USER nodeapp
EXPOSE 3000
CMD ["node", "dist/server.js"]

node_modules
.git
.github
*.md
.env*
coverage/
dist/
.DS_Store

name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  ci:
    name: Lint, Typecheck, Test
    runs-on: ubuntu-latest

    services:
      # Spin up a Postgres container for integration tests
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_USER: testuser
          POSTGRES_PASSWORD: testpass
          POSTGRES_DB: testdb
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5

    env:
      DATABASE_URL: postgresql://testuser:testpass@localhost:5432/testdb
      NODE_ENV: test
      JWT_ACCESS_SECRET: test-access-secret-min-32-chars-long
      JWT_REFRESH_SECRET: test-refresh-secret-min-32-chars-long

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'           # caches node_modules between runs

      - name: Install dependencies
        run: npm ci

      - name: Lint
        run: npm run lint

      - name: Type check
        run: npx tsc --noEmit

      - name: Run migrations (for integration tests)
        run: npx prisma migrate deploy
        # or: npx drizzle-kit migrate

      - name: Run tests
        run: npm test -- --coverage

      - name: Upload coverage report
        uses: actions/upload-artifact@v4
        if: always()
        with:
          name: coverage-report
          path: coverage/
          retention-days: 7

# Create the repository
aws ecr create-repository   --repository-name my-app   --region ap-south-1   --image-scanning-configuration scanOnPush=true

# Note the repository URI from the output:
# 123456789.dkr.ecr.ap-south-1.amazonaws.com/my-app

# 1. Create the OIDC provider in AWS IAM (once per account)
aws iam create-open-id-connect-provider   --url https://token.actions.githubusercontent.com   --client-id-list sts.amazonaws.com   --thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1

# 2. Create a trust policy file
cat > trust-policy.json << 'EOF'
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "Federated": "arn:aws:iam::YOUR_ACCOUNT_ID:oidc-provider/token.actions.githubusercontent.com"
    },
    "Action": "sts:AssumeRoleWithWebIdentity",
    "Condition": {
      "StringEquals": {
        "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
      },
      "StringLike": {
        "token.actions.githubusercontent.com:sub": "repo:YOUR_GITHUB_USERNAME/YOUR_REPO:*"
      }
    }
  }]
}
EOF

# 3. Create the IAM role
aws iam create-role   --role-name github-actions-deploy   --assume-role-policy-document file://trust-policy.json

# 4. Attach ECR push permissions
aws iam attach-role-policy   --role-name github-actions-deploy   --policy-arn arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser

name: Deploy

on:
  push:
    branches: [main]

# Cancel in-progress deploys if a new push arrives
concurrency:
  group: deploy-production
  cancel-in-progress: false  # never cancel an in-progress deploy

jobs:
  deploy:
    name: Build and Deploy
    runs-on: ubuntu-latest
    # Require CI to pass first — reuse the ci.yml run
    needs: []   # ci.yml runs separately; branch protection enforces it

    permissions:
      id-token: write   # required for OIDC
      contents: read

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Configure AWS credentials (OIDC — no long-lived keys)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Login to Amazon ECR
        id: login-ecr
        uses: aws-actions/amazon-ecr-login@v2

      - name: Build, tag, and push Docker image to ECR
        id: build-image
        env:
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: ${{ secrets.ECR_REPOSITORY }}
          IMAGE_TAG: ${{ github.sha }}
        run: |
          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG .
          docker build -t $ECR_REGISTRY/$ECR_REPOSITORY:latest .
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
          docker push $ECR_REGISTRY/$ECR_REPOSITORY:latest
          echo "image=$ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG" >> $GITHUB_OUTPUT

      - name: Deploy to EC2 via SSH
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.EC2_HOST }}
          username: ${{ secrets.EC2_USERNAME }}
          key: ${{ secrets.EC2_SSH_KEY }}
          envs: AWS_REGION,ECR_REGISTRY,ECR_REPOSITORY,IMAGE_TAG
          script: |
            # Login to ECR from EC2 (uses instance role)
            aws ecr get-login-password --region $AWS_REGION |               docker login --username AWS --password-stdin $ECR_REGISTRY

            # Pull the new image
            docker pull $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG

            # Stop old container gracefully
            docker stop my-app 2>/dev/null || true
            docker rm my-app 2>/dev/null || true

            # Start new container
            docker run -d               --name my-app               --restart unless-stopped               -p 3000:3000               -e NODE_ENV=production               -e AWS_REGION=$AWS_REGION               $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG

            # Wait for health check
            sleep 5
            curl -f http://localhost:3000/health || exit 1

            # Clean up old images (keep last 3)
            docker image prune -f
            echo "Deployment complete: $IMAGE_TAG"
        env:
          AWS_REGION: ${{ secrets.AWS_REGION }}
          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
          ECR_REPOSITORY: ${{ secrets.ECR_REPOSITORY }}
          IMAGE_TAG: ${{ github.sha }}

import { Router } from 'express';
import { db } from '../lib/db';

const router = Router();

router.get('/health', async (req, res) => {
  try {
    // Verify database connectivity
    await db.$queryRaw`SELECT 1`;
    res.json({
      status: 'ok',
      timestamp: new Date().toISOString(),
      version: process.env.npm_package_version,
    });
  } catch {
    res.status(503).json({ status: 'error', message: 'Database unreachable' });
  }
});

export default router;

      - name: Notify Slack on failure
        if: failure()
        uses: slackapi/slack-github-action@v1
        with:
          payload: |
            {
              "text": ":red_circle: Deploy failed for *${{ github.repository }}*",
              "blocks": [{
                "type": "section",
                "text": {
                  "type": "mrkdwn",
                  "text": ":red_circle: *Deploy failed*
*Repo:* ${{ github.repository }}
*Branch:* ${{ github.ref_name }}
*Commit:* ${{ github.sha }}
*Author:* ${{ github.actor }}
*<${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View Run>*"
                }
              }]
            }
        env:
          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '22', cache: 'npm' }
      - run: npm ci
      - run: npm run lint

  typecheck:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '22', cache: 'npm' }
      - run: npm ci
      - run: npx tsc --noEmit

  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16-alpine
        # ... (same as before)
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '22', cache: 'npm' }
      - run: npm ci && npm test

  # Deploy only after all three pass
  deploy:
    needs: [lint, typecheck, test]
    # ... (deploy job)