Deployment & DevOps: CI/CD, Cloud Platforms & Reliability

# --- Option A: Netlify (_redirects file in public/ or dist/ directory) ---
# Catch-all rule: redirects every route to index.html with a 200 HTTP status
/*    /index.html   200

# Optional: Proxy API requests to backend server to avoid CORS issues
/api/*  https://api.devascentacademy.me/:splat  200

# --- Option B: Vercel (vercel.json in project root) ---
{
  "rewrites": [
    {
      "source": "/(.*)",
      "destination": "/index.html"
    }
  ],
  "headers": [
    {
      "source": "/assets/(.*)",
      "headers": [
        {
          "key": "Cache-Control",
          "value": "public, max-age=31536000, immutable"
        }
      ]
    }
  ]
}

# Stage 1: Dependency resolution and compilation
FROM node:20-alpine AS builder
WORKDIR /app

# Cache dependency installation layer
COPY package*.json ./
RUN npm ci

# Copy source code and run build (TypeScript / Vite / Next.js)
COPY . .
RUN npm run build --if-present

# Stage 2: Minimal lean production runner image
FROM node:20-alpine AS runner
WORKDIR /app

# Set production environment flags
ENV NODE_ENV=production

# Run as a non-privileged root user for security compliance
USER node

COPY --chown=node:node package*.json ./
# Install ONLY production dependencies (no dev tools or compilers)
RUN npm ci --only=production && npm cache clean --force

# Copy built artifacts from the builder stage
COPY --from=builder --chown=node:node /app/dist ./dist

# Render/AWS dynamically assign PORT at runtime
EXPOSE 8080

CMD ["node", "dist/server.js"]

import dotenv from 'dotenv';
import { z } from 'zod';

// Load .env file for local development
dotenv.config();

// Define strict schema for all mandatory production environment variables
const envSchema = z.object({
  NODE_ENV: z.enum(['development', 'test', 'production']).default('development'),
  PORT: z.string().regex(/^\d+$/).transform(Number).default('8080'),
  DATABASE_URL: z.string().url({ message: 'DATABASE_URL must be a valid PostgreSQL connection URI' }),
  JWT_SECRET: z.string().min(32, 'JWT_SECRET must be at least 32 characters for security'),
  ALLOWED_ORIGIN: z.string().url()
});

// Validate process.env on server boot: fail immediately if misconfigured!
const parseResult = envSchema.safeParse(process.env);

if (!parseResult.success) {
  console.error('❌ FATAL: Invalid application environment configuration:');
  console.error(JSON.stringify(parseResult.error.format(), null, 2));
  process.exit(1); // Abort startup before serving compromised traffic
}

export const env = parseResult.data;

name: Production CI/CD Pipeline

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  test:
    name: Automated Verification & Linting
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Setup Node.js Runtime
        uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: 'npm'

      - name: Install Clean Dependencies
        run: npm ci

      - name: Run Linter Check
        run: npm run lint

      - name: Execute Unit & Integration Tests
        run: npm test -- --coverage
        env:
          CI: true
          NODE_ENV: test

  deploy:
    name: Trigger Production Deployment
    needs: [ test ]
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-latest

    steps:
      - name: Trigger Render Production Webhook
        run: |
          curl -f -X POST "${{ secrets.RENDER_DEPLOY_HOOK_URL }}" \
               -H "Content-Type: application/json"
      
      - name: Verify Production Health Endpoint
        run: |
          sleep 15
          curl -f https://api.devascentacademy.me/healthz || exit 1

import express from 'express';
import pino from 'pino';
import http from 'http';

// Initialize high-performance structured JSON logger
const logger = pino({
  level: process.env.LOG_LEVEL || 'info',
  formatters: {
    level: (label) => ({ level: label })
  }
});

const app = express();
const PORT = process.env.PORT || 8080;

// 1. Standard Liveness & Readiness Health Check Endpoint
app.get('/healthz', (req, res) => {
  const healthStatus = {
    status: 'healthy',
    uptimeSeconds: Math.floor(process.uptime()),
    timestamp: new Date().toISOString(),
    memory: process.memoryUsage()
  };
  res.status(200).json(healthStatus);
});

// 2. Structured Request Logging Middleware
app.use((req, res, next) => {
  const start = Date.now();
  res.on('finish', () => {
    logger.info({
      method: req.method,
      url: req.originalUrl,
      statusCode: res.statusCode,
      durationMs: Date.now() - start,
      ip: req.ip
    }, 'HTTP request executed');
  });
  next();
});

const server = http.createServer(app);

server.listen(PORT, () => {
  logger.info({ port: PORT, env: process.env.NODE_ENV }, 'Application server started');
});

// 3. Graceful Shutdown Routine (Handling SIGTERM / SIGINT from Docker/K8s/Render)
const shutdown = (signal) => {
  logger.warn({ signal }, 'Received kill signal. Initiating graceful shutdown...');
  
  server.close(() => {
    logger.info('All active HTTP connections closed. Releasing database pools...');
    // Close database connections or message brokers here
    process.exit(0);
  });

  // Force exit if cleanup takes longer than 10 seconds
  setTimeout(() => {
    logger.error('Graceful shutdown timed out. Forcing process termination.');
    process.exit(1);
  }, 10000).unref();
};

process.on('SIGTERM', () => shutdown('SIGTERM'));
process.on('SIGINT', () => shutdown('SIGINT'));

services:
  # --- Full-Stack Node.js API Web Service ---
  - type: web
    name: devascent-api
    runtime: node
    region: oregon
    plan: starter
    buildCommand: npm ci && npm run build
    startCommand: npm run db:migrate && npm start
    healthCheckPath: /healthz
    autoDeploy: true
    envVars:
      - key: NODE_ENV
        value: production
      - key: DATABASE_URL
        fromDatabase:
          name: devascent-db
          property: connectionString
      - key: JWT_SECRET
        generateValue: true

databases:
  # --- Managed PostgreSQL Database Instance ---
  - name: devascent-db
    region: oregon
    plan: starter
    databaseName: devascent_production
    user: devascent_admin