Dockerfile

GitHub Actions CI Pipeline

Build, test, and Docker push workflow — the YAML IT teams bookmark for Node and Java projects

📋Configuration Files

.github/workflows/ci.yml

Node.js — install, test, build Docker image, push to registry

yaml
1name: CI Pipeline
2
3on:
4 push:
5 branches: [main, develop]
6 pull_request:
7 branches: [main]
8
9env:
10 REGISTRY: ghcr.io
11 IMAGE_NAME: ${{ github.repository }}
12
13jobs:
14 build-and-test:
15 runs-on: ubuntu-latest
16 steps:
17 - uses: actions/checkout@v4
18
19 - name: Setup Node.js
20 uses: actions/setup-node@v4
21 with:
22 node-version: "20"
23 cache: "npm"
24
25 - name: Install dependencies
26 run: npm ci
27
28 - name: Run tests
29 run: npm test
30
31 - name: Build Docker image
32 run: docker build -t ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }} .
33
34 - name: Log in to GitHub Container Registry
35 if: github.event_name == 'push' && github.ref == 'refs/heads/main'
36 uses: docker/login-action@v3
37 with:
38 registry: ${{ env.REGISTRY }}
39 username: ${{ github.actor }}
40 password: ${{ secrets.GITHUB_TOKEN }}
41
42 - name: Push image
43 if: github.event_name == 'push' && github.ref == 'refs/heads/main'
44 run: docker push ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}

.github/workflows/java-ci.yml

Spring Boot / Maven — compile, test, package JAR

yaml
1name: Java CI
2
3on:
4 push:
5 branches: [main]
6 pull_request:
7 branches: [main]
8
9jobs:
10 build:
11 runs-on: ubuntu-latest
12 steps:
13 - uses: actions/checkout@v4
14
15 - name: Set up JDK 21
16 uses: actions/setup-java@v4
17 with:
18 java-version: "21"
19 distribution: "temurin"
20 cache: maven
21
22 - name: Build and test
23 run: mvn -B verify
24
25 - name: Upload JAR artifact
26 uses: actions/upload-artifact@v4
27 with:
28 name: app-jar
29 path: target/*.jar

CI pipeline: minimal vs production

What to add before production merge

AspectMinimalProduction
Authlong-lived AWS keys in secretsOIDC role (AWS_ROLE_ARN) — no static keys
Scanbuild + push onlyTrivy/Snyk scan gate before push
Deploykubectl apply on every pushmain only; PR = plan/dry-run; env branches
SecretsKUBECONFIG in repo secretIRSA + short-lived tokens; rotate quarterly
Concurrencynonecancel-in-progress on same branch
Branch protectionnonerequired reviews + status checks on main
📄

Step 01

Use the Workflow

(01)Add workflow to your repo

Linux
1mkdir -p .github/workflows
2cp ci.yml .github/workflows/ci.yml
3git add .github/workflows/
4git commit -m "Add CI pipeline"
5git push origin main
6# View runs: GitHub → Actions tab

(02)Add secrets (for registry push)

Linux
1# GitHub repo → Settings → Secrets and variables → Actions
2# GITHUB_TOKEN is automatic; add DOCKERHUB_TOKEN if pushing to Docker Hub