CD-01: Application Code Deployment Pipeline

flowchart LR
    subgraph "Source"
        A[GitHub Push to main] --> B[Webhook Trigger]
    end

    subgraph "CI Phase (5 min)"
        B --> C[Lint + Static Analysis]
        C --> D[Unit Tests + Coverage]
        D --> E[Integration Tests]
        E --> F[Build Docker Image]
        F --> G[ECR Push + Vulnerability Scan]
    end

    subgraph "CD Phase (8 min)"
        G --> H{ECS or Lambda?}
        H -->|ECS Services| I[Blue/Green Deploy]
        H -->|Lambda Functions| J[Version + Alias Shift]
        I --> K[Health Check + Canary]
        J --> K
        K -->|Pass| L[Full Traffic Shift]
        K -->|Fail| M[Automatic Rollback]
    end

    subgraph "Post-Deploy"
        L --> N[Smoke Tests]
        N --> O[CloudWatch Metrics]
        O --> P[Slack Notification]
    end

    M --> P

    style A fill:#ff9900,color:#000
    style L fill:#1B660F,color:#fff
    style M fill:#DD344C,color:#fff

gitGraph
    commit id: "feature-A merged"
    branch feature-B
    commit id: "WIP"
    checkout main
    commit id: "feature-C merged"
    commit id: "hotfix-1"
    checkout feature-B
    commit id: "ready"
    checkout main
    merge feature-B id: "feature-B merged"
    commit id: "deploy-tag-v1.42"

name: deploy-chatbot
on:
  push:
    branches: [main]
    paths:
      - 'src/**'
      - 'Dockerfile'
      - 'requirements.txt'
      - 'package.json'
  workflow_dispatch:
    inputs:
      environment:
        type: choice
        options: [staging, production]

concurrency:
  group: deploy-${{ github.ref }}
  cancel-in-progress: false  # Never cancel in-flight deploys

flowchart TD
    A[Checkout Code] --> B[Install Dependencies]
    B --> C{Parallel Jobs}
    C --> D[Python Lint — ruff + mypy]
    C --> E[Unit Tests — pytest]
    C --> F[TypeScript Lint — eslint]
    C --> G[Security Scan — Bandit + Semgrep]

    D --> H{All Pass?}
    E --> H
    F --> H
    G --> H

    H -->|Yes| I[Build Docker Image]
    H -->|No| J[Fail + Notify]

    I --> K[Trivy Vulnerability Scan]
    K -->|No Critical/High| L[Push to ECR]
    K -->|Critical/High Found| J

    L --> M[Tag: sha-abc123 + latest]

# Build stage
FROM python:3.11-slim AS builder
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir --target=/deps -r requirements.txt

# Runtime stage
FROM python:3.11-slim
WORKDIR /app
COPY --from=builder /deps /usr/local/lib/python3.11/site-packages
COPY src/ ./src/
EXPOSE 8080
HEALTHCHECK --interval=15s --timeout=5s --retries=3 \
    CMD curl -f http://localhost:8080/health || exit 1
CMD ["uvicorn", "src.main:app", "--host", "0.0.0.0", "--port", "8080"]

- name: Build and push to ECR
  env:
    ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
    IMAGE_TAG: sha-${{ github.sha }}
  run: |
    docker build -t $ECR_REGISTRY/mangaassist-chatbot:$IMAGE_TAG .
    docker push $ECR_REGISTRY/mangaassist-chatbot:$IMAGE_TAG

sequenceDiagram
    participant GH as GitHub Actions
    participant CD as CodeDeploy
    participant ECS as ECS Fargate
    participant ALB as ALB
    participant CW as CloudWatch

    GH->>CD: Create deployment (new task def)
    CD->>ECS: Launch GREEN task set
    ECS-->>CD: Tasks healthy
    CD->>ALB: Route 10% to GREEN
    CD->>CW: Start canary monitoring (5 min)

    alt Metrics healthy
        CD->>ALB: Route 50% to GREEN
        CD->>CW: Monitor 3 more min
        CD->>ALB: Route 100% to GREEN
        CD->>ECS: Drain BLUE task set
        CD-->>GH: Deployment SUCCESS
    else Metrics degraded
        CD->>ALB: Route 100% back to BLUE
        CD->>ECS: Terminate GREEN tasks
        CD-->>GH: Deployment ROLLED BACK
    end

# Update task definition with new image
def update_task_definition(family: str, new_image: str) -> str:
    ecs = boto3.client('ecs')

    # Get current task definition
    current = ecs.describe_task_definition(taskDefinition=family)
    task_def = current['taskDefinition']

    # Update container image
    for container in task_def['containerDefinitions']:
        if container['name'] == 'chatbot':
            container['image'] = new_image

    # Register new revision (keep all other config identical)
    response = ecs.register_task_definition(
        family=family,
        containerDefinitions=task_def['containerDefinitions'],
        taskRoleArn=task_def['taskRoleArn'],
        executionRoleArn=task_def['executionRoleArn'],
        networkMode=task_def['networkMode'],
        requiresCompatibilities=['FARGATE'],
        cpu=task_def['cpu'],
        memory=task_def['memory'],
    )
    return response['taskDefinition']['taskDefinitionArn']

version: 0.0
Resources:
  - TargetService:
      Type: AWS::ECS::Service
      Properties:
        TaskDefinition: <TASK_DEFINITION>
        LoadBalancerInfo:
          ContainerName: "chatbot"
          ContainerPort: 8080
        PlatformVersion: "LATEST"
Hooks:
  - BeforeAllowTraffic: "validate-deployment"
  - AfterAllowTraffic: "run-smoke-tests"

# Lambda version + alias deployment with weighted traffic
def deploy_lambda(function_name: str, s3_bucket: str, s3_key: str):
    lmb = boto3.client('lambda')

    # Update function code
    lmb.update_function_code(
        FunctionName=function_name,
        S3Bucket=s3_bucket,
        S3Key=s3_key,
    )
    lmb.get_waiter('function_updated_v2').wait(FunctionName=function_name)

    # Publish new version
    version = lmb.publish_version(
        FunctionName=function_name,
        Description=f"Deploy {s3_key}"
    )['Version']

    # Shift 5% traffic to new version for canary
    lmb.update_alias(
        FunctionName=function_name,
        Name='live',
        FunctionVersion=version,
        RoutingConfig={
            'AdditionalVersionWeights': {
                version: 0.05  # 5% canary
            }
        }
    )
    return version

flowchart TD
    A[Canary Running] --> B{5xx > 1%?}
    B -->|Yes| C[IMMEDIATE ROLLBACK]
    B -->|No| D{P95 > 3s?}
    D -->|Yes| C
    D -->|No| E{Health checks failing?}
    E -->|Yes| C
    E -->|No| F{Error log spike?}
    F -->|Yes| G[Alert Team — Hold Deploy]
    F -->|No| H[Proceed to Next Traffic %]

    C --> I[Route 100% to BLUE]
    C --> J[Post to Slack with Root Cause]
    C --> K[Create Incident Ticket]

# Automated smoke test suite run after each deployment
import httpx

SMOKE_TESTS = [
    {
        "name": "health_check",
        "method": "GET",
        "path": "/health",
        "expected_status": 200,
    },
    {
        "name": "chat_basic",
        "method": "POST",
        "path": "/api/v1/chat",
        "body": {"message": "What manga do you recommend?", "session_id": "smoke-test"},
        "expected_status": 200,
        "max_latency_ms": 3000,
    },
    {
        "name": "intent_classification",
        "method": "POST",
        "path": "/api/v1/classify",
        "body": {"message": "I want to return my order"},
        "expected_status": 200,
        "expected_intent": "order_return",
    },
]

async def run_smoke_tests(base_url: str) -> bool:
    async with httpx.AsyncClient(timeout=10.0) as client:
        for test in SMOKE_TESTS:
            response = await client.request(
                test["method"],
                f"{base_url}{test['path']}",
                json=test.get("body"),
            )
            if response.status_code != test["expected_status"]:
                return False
            if "max_latency_ms" in test:
                if response.elapsed.total_seconds() * 1000 > test["max_latency_ms"]:
                    return False
    return True

graph LR
    subgraph "GitHub Actions"
        GA1[Native GitHub integration]
        GA2[Rich marketplace]
        GA3[YAML workflows]
        GA4[Community familiarity]
    end

    subgraph "AWS CodePipeline"
        CP1[Deep AWS integration]
        CP2[IAM native auth]
        CP3[CodeDeploy blue/green]
        CP4[No external dependency]
    end

    subgraph "GitLab CI"
        GL1[Built-in registry]
        GL2[Auto DevOps]
        GL3[Self-hosted runners]
        GL4[Compliance features]
    end

flowchart LR
    A[New Version Deployed] --> B[0% Traffic — Health Checks Only]
    B -->|All healthy| C[10% Traffic — 5 min canary]
    C -->|Metrics OK| D[50% Traffic — 3 min]
    D -->|Metrics OK| E[100% Traffic — BLUE drained]

    C -->|Metrics Bad| F[Rollback to BLUE]
    D -->|Metrics Bad| F

graph TD
    subgraph "Product Manager"
        PM1["Ship features faster"]
        PM2["Daily deploys minimum"]
        PM3["Customers waiting for fixes"]
    end

    subgraph "Architect"
        AR1["Zero production incidents"]
        AR2["Full regression before deploy"]
        AR3["1-hour canary minimum"]
    end

    subgraph "Team Lead"
        TL1["Team doesn't burn out"]
        TL2["Auto-everything, manual-nothing"]
        TL3["Pipeline < 15 min"]
    end

    PM1 ---|"Tension"| AR2
    PM2 ---|"Tension"| AR3
    AR1 ---|"Tension"| TL3
    TL2 ---|"Enables"| PM2
    TL2 ---|"Enables"| AR1

pie title "15-Minute Pipeline Budget Allocation"
    "Lint + Static Analysis" : 1
    "Unit Tests" : 2
    "Integration Tests" : 2
    "Docker Build + Scan" : 3
    "Blue/Green Deploy" : 5
    "Smoke Tests" : 2