GitHub Actions: Çykyşy awtomatlaşdyrmak

(Bölüm: Tehnologiýalar we infrastruktura)

Gysgaça gysgaça

GitHub Actions - ammardaky ýerli "konweýer". iGaming üçin bular arka, öň, ETL/DBT we ML/LLM hyzmatlarynyň çalt we howpsuz çykarylmagydyr: synag matrisalary, garaşlylyk keşleri, izolirlenen howuzlar, bitewi standartlar üçin Reusable Workflows, uzak möhletli syrlaryň ýerine OIDC, gol we SBOM, bellikler we GitOps-manifestleriň bamplary boýunça neşirler. Açar - p99 we çykdajylary gözegçilik astynda saklamak üçin hil/howpsuzlyk şablonlary we geýtleri.

1) Binagärlik ýörelgeleri

Kod hökmünde paýlaýynlar ('.github/workflows/.yml'), Reusable/Composite Actions arkaly DRY.
Runner-howuzlar: hosted (ubuntu-latest) + self-hosted (K8s/VM, GPU for ML).
Gurşaw (Environments): 'dev/stage/prod' required reviewers, wagt we daşky gurşaw syrlary bilen.
Syýasatlar: protected branches/tags, CODEOWNERS, hökmany barlaglar.
Syn edilişi: job summaries, artefaktlar, logirleme, dowamlylyk metrikleri.

2) CI → CD (backend) esasy şablon

yaml name: ci-cd-backend on:
pull_request:
branches: [ main ]
push:
tags: [ "v" ]
permissions:
contents: read id-token: write    # для OIDC packages: write

env:
IMAGE: ghcr. io/${{ github. repository }}/api:${{ github. sha }}

jobs:
lint_test:
runs-on: ubuntu-latest steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5 with: { python-version: '3. 12' }
- name: Cache pip uses: actions/cache@v4 with:
path: ~/.cache/pip key: pip-${{ runner. os }}-${{ hashFiles('requirements. txt') }}
- run: pip install -r requirements. txt
- run: make lint && make test
- name: Build & push image (BuildKit)
uses: docker/build-push-action@v6 with:
push: ${{ github. event_name == 'push' }}
tags: ${{ env. IMAGE }}
cache-from: type=gha cache-to: type=gha,mode=max

security:
needs: [ lint_test ]
runs-on: ubuntu-latest steps:
- uses: actions/checkout@v4
- name: SCA/SAST/Secrets uses: your-org/security-composite@v3  # Composite Action вашей орг.

release_prod:
if: startsWith(github. ref, 'refs/tags/v')
needs: [ security ]
runs-on: ubuntu-latest environment: production steps:
- uses: actions/checkout@v4
- name: SBOM & Sign uses: your-org/sbom-sign-action@v2 with:
image: ${{ env. IMAGE }}
- name: GitOps bump manifests uses: your-org/gitops-bump@v2 with:
image: ${{ env. IMAGE }}
path: apps/api/values. yaml

Ideýa: PR → lint/birlik → howpsuzlyk → 'v' - SBOM/gol we GitOps-bamp manifestleri deploi üçin.

3) Gaýtadan ulanmak: Reusable/Composite

Reusable Workflows: ähli hyzmatlar üçin birmeňzeş pipeline şablonlary (aýratyn repo '.github' -da).
Composite Actions: gaýtalanýan ädimleri ýelmemek (lint/unit/skan).

yaml jobs:
ci_template:
uses: your-org/ci-templates/.github/workflows/python. yml@v3 with:
python: '3. 12'
run-tests: true

4) Matrisalar, kesiş we öndürijilik

`strategy. matrix 'paralel synaglar üçin (diller/DB/OS).
Garaşlylyk üçin 'actions/cache' kesе; BuildKit с `cache-to: gha`; dependency proxies.
Bäsdeşlik ukyby: 'concurrency: group: api- $ {{github. ref}}, cancel-in-progress: true '- minutlary tygşytlaýar.
Artefaktlar: hasabatlary/örtükleri/profilleri 'retention-days' bilen saklamak.

yaml strategy:
matrix:
py: [ '3. 10', '3. 12' ]
db: [ 'mysql', 'postgres' ]

5) Environments и approvals

Required reviewers for 'production' (Goll Gate).
Daşky gurşawyň gizlinlikleri: deploi bellikleri, gol açarlary, stendleriň URL-leri.
Çykdajylara gözegçilik etmek üçin deslapky gurşaw (auto-expire) ömri.

6) OIDC-bulutlara girmek (uzak wagtlap gizlin)

'id-token: write' -ni açyň, bulutda trust-policy sazlaň we wagtlaýyn kredenşllary ulanyň.
AWS/Azure/GCP/artefakt-sanawlar/gizlin-dolandyryjylar üçin ulanylýar.
least privilege: 'dev/stage/prod' -da aýratyn rollar.

yaml
- name: Assume cloud role via OIDC uses: your-org/oidc-assume@v1 with:
role: arn:aws:iam::123:role/gha-deploy-prod

7) Relizler, taglar we artefaktlar

Tag boýunça release: changelog, release-assets, şekilleri/paketleri çap etmek.
Immutability: "diňe öňe" bellikleri, konteýnerleriň/tertipleriň goly.
SBOM (CycloneDX/SPDX) + gol (cosign/sigstore) - derweze "golsyz - deploi ýok".

8) GitOps и progressive delivery

CD "Actions" -dan däl-de, PR/commit arkaly manifest-repoda (Argo CD/Flux).
Canary/blue-green: GitOps-bampa agramy/wersiýasy; SLO-metrikler boýunça awto-mahabat.

yaml
- uses: mikefarah/yq@v4 with:
cmd: yq -i '.image = strenv(IMAGE)' apps/api/values. yaml
- run:
git config user. name "gha-bot"
git commit -am "bump api -> $IMAGE" && git push

9) Paýlaýnyň we üpjünçilik zynjyrynyň howpsuzlygy

Kimler işe girizip biler: Diňe goragdan branches/tags, bilen required checks.
Skaner: SAST/SCA/Secret-scan, DAST.
Gollar: şekiller, Helm-diagrammalar, binarnikler; deploýda barlamak.
Syýasatçylar: diňe ynanylan workflowlardan jedel edýänler; üçünji taraplar üçin pin SHA.

10) Synlamak, SLO we ChatOps

Jemi hasabatlar (JUnit/coverage/skanlar), PR-daky statuslar.
Metrikler: tapgyrlaryň dowamlylygy, üstünlik/feýla, "rannerleriň nobaty".
ChatOps: "workflow _ dispatch" arkaly "/promote ", "/rollback" buýruklary.

11) FinOps (minutlaryň we çeşmeleriň bahasy)

PR üçin Concurency-cancel, matrisa diňe üýtgän bölekler üçin (paths-filter).
Artefaktlaryň arassaçylygy: 'retention-days', awtomatiki örtük preview env.
Self-hosted agyr gurnama howuzlary/ML, gijeki "asuda sagatlar".
Dependency cache we BuildKit GHA-kesh - ep-esli tygşytlamak.

12) Monorepo we Parent/Child-orkestri

Bukjalar/ýollar boýunça triggerler: komponentde garaşsyz workflow.
Toparlaryň arasynda standartlaşdyryş gatlagy hökmünde reusable (Payments/Risk/CRM/ETL/ML).
Syrlary/gurşawy komponentler boýunça bölmek.

13) iGaming üçin şablonlar

A) Backend/API (Go/Node/Python)

yaml name: backend on: [ pull_request, push ]
jobs:
ci:
uses: your-org/ci-templates/.github/workflows/backend. yml@v3 release:
if: startsWith(github. ref, 'refs/tags/v')
uses: your-org/ci-templates/.github/workflows/release. yml@v3 secrets: inherit

Б) ETL/DBT

yaml name: etl-dbt on: [ pull_request ]
jobs:
dbt:
runs-on: ubuntu-latest steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5 with: { python-version: '3. 11' }
- run: pip install dbt-core dbt-bigquery
- run: dbt deps && dbt run && dbt test
- name: Publish docs run: dbt docs generate && tar czf docs. tgz target/
load artifact, retention period 3 days uses: actions/upload-artifact @ v4 with: {name: dbt-docs, path: docs. tgz, retention-days: 3 }

B) ML/LLM (inferens-artefaktlar)

yaml name: ml-pack on:
push:
tags: [ "model-" ]
jobs:
build-engine:
runs-on: self-hosted-gpu steps:
- uses: actions/checkout@v4
- run: python export_onnx. py
- run: trtexec --onnx=model. onnx --saveEngine=model. plan
- uses: actions/upload-artifact@v4 with: { name: engine, path: model. plan, retention-days: 7 }
- name: Sign & SBOM uses: your-org/sbom-sign-action@v2 with: { file: model. plan }

14) Girizmegiň çek-sanawy

1. CI/CD (Reusable/Composite) şablonlaryny kesgitläň we olary ähli repolara ulanyň.
2. Environments-i approvals we aýry-aýry syrlar bilen açyň.
3. OIDC-e bulutlara/gizlin dolandyryjylara geçiň, çydamly açarlary aýyryň.
4. SAST/SCA/Secrets/DAST, SBOM we artefaktlaryň goluny giriziň; möhüm gowşaklyklar boýunça geýtlar.
5. GitOps: manifest-repo, şekilleriň/wersiýalaryň awto-bamplary, canary/blue-green.
6. Cache/matrisa, 'concurrency. cancel-in-progress ', artefaktlary arassalamak.
7. Öz-hosted runner-howuzlary (şol sanda GPU) çäklendirmeler we izolýasiýa bilen açyň.
8. Artykmaç joblary kowmazlyk üçin paths-filter we rule sazlamalaryny açyň.
9. ChatOps goşuň: statuslar/buýruklar; PR hasabatlary.
10. Actions (SHA pin, daşarky çäkleri) howpsuz ulanmak syýasatlaryny düzüň.

15) Antipatternler

Reusable/Composite → rasinxron standartlarynyň ýerine ähli repolarda birmeňzeş ädimler.
OIDC-iň ýerine üýtgeýjilerde uzak wagtlap dowam edýän bulut syrlary.
Önümler üçin Environments/approvals ýoklugy.
Daşarky Actions → supply-chain töwekgelçilikleri.
SBOM/gollar ýok → CD barlamak ýok.
Elmydama açylýan massiw matrisalar → çykdajylaryň ýokarlanmagy.
Actions-dan CD-ler GitOps-tracking üýtgeşmeleri bolmazdan gönüden-göni önüme.

Netijeler

GitHub Actions ýeke-täk, howpsuz we ýerine ýetirilip bilinjek çykaryş konweýerini gurmaga mümkinçilik berýär: "Reusable/Composite" arkaly paýlaýjylary standartlaşdyryň, OIDC we approvals bilen gurşawy ulanyň, SBOM/goly giriziň, CD-ni progressiw delivery bilen GitOps-a geçiriň, çykdajylar bolsa keş/matrisa/bäsdeşlik arkaly gözegçilik astynda. Şeýle çemeleşme iGaming-önümiň tizligine görä giňeldilýär, hilini saklaýar we amal töwekgelçiligini peseldýär.