GitHub Actions: relizlarni avtomatlashtirish

(Bo’lim: Texnologiyalar va infratuzilma)

Qisqacha xulosa

GitHub Actions - repozitoriyadagi mahalliy «kod sifatida» konveyer. iGaming uchun bu orqa panellar, frontendlar, ETL/DBT va ML/LLM xizmatlarining tezkor va xavfsiz relizlari: test matritsalari, qaramlik keshlari, izolyatsiyalangan runner-pullar, yagona standartlar uchun Reusable Workflows, uzoq umr ko’radigan sirlar o’rniga OIDC, imzo va SBOM, teglar bo’yicha relizlar va manifestlarning GitOps-bamplari. Kalit - p99 va xarajatlarni nazorat qilish uchun sifat/xavfsizlik shablonlari va geytlari.

1) Arxitektura prinsiplari

Payplaynlar kod sifatida (’.github/workflows/.yml’), Reusable/Composite Actions orqali DRY.
Runner-pullar: hosted (ubuntu-latest) + self-hosted (K8s/VM, ML uchun GPU).
Muhit (Environments):’dev/stage/prod’required reviewers, taymautlar va atrof-muhit sirlari bilan.
Siyosatchilar: protected branches/tags, CODEOWNERS, majburiy tekshiruvlar.
Kuzatilganlik: job summaries, artefaktlar, loglar, davomiylik metrikalari.

2) Asosiy CI → CD (backend) namunasi

yaml name: ci-cd-backend on:
pull_request:
branches: [ main ]
push:
tags: [ "v" ]
permissions:
contents: read id-token: write    # для OIDC packages: write

env:
IMAGE: ghcr. io/${{ github. repository }}/api:${{ github. sha }}

jobs:
lint_test:
runs-on: ubuntu-latest steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5 with: { python-version: '3. 12' }
- name: Cache pip uses: actions/cache@v4 with:
path: ~/.cache/pip key: pip-${{ runner. os }}-${{ hashFiles('requirements. txt') }}
- run: pip install -r requirements. txt
- run: make lint && make test
- name: Build & push image (BuildKit)
uses: docker/build-push-action@v6 with:
push: ${{ github. event_name == 'push' }}
tags: ${{ env. IMAGE }}
cache-from: type=gha cache-to: type=gha,mode=max

security:
needs: [ lint_test ]
runs-on: ubuntu-latest steps:
- uses: actions/checkout@v4
- name: SCA/SAST/Secrets uses: your-org/security-composite@v3  # Composite Action вашей орг.

release_prod:
if: startsWith(github. ref, 'refs/tags/v')
needs: [ security ]
runs-on: ubuntu-latest environment: production steps:
- uses: actions/checkout@v4
- name: SBOM & Sign uses: your-org/sbom-sign-action@v2 with:
image: ${{ env. IMAGE }}
- name: GitOps bump manifests uses: your-org/gitops-bump@v2 with:
image: ${{ env. IMAGE }}
path: apps/api/values. yaml

G’oya: PR → lint/birlik → xavfsizlik →’v’tegi bo’yicha - SBOM/imzo va deploy uchun GitOps-bamp manifestlari.

3) Qayta foydalanish: Reusable/Composite

Reusable Workflows: barcha xizmatlar uchun yagona pipeline shablonlari (alohida repo’.github’da).
Composite Actions: takrorlanuvchi qadamlarni yopishtirish (lint/unit/skanlar).

yaml jobs:
ci_template:
uses: your-org/ci-templates/.github/workflows/python. yml@v3 with:
python: '3. 12'
run-tests: true

4) Matritsalar, kesh va unumdorlik

`strategy. matrix’parallel testlar uchun (tillar/DB/OS).
Bogʻlanishlar uchun’actions/cache’kesh; BuildKit с `cache-to: gha`; dependency proxies.
Raqobatbardoshlik:’concurrency: group: api- $ {{github. ref}}, cancel-in-progress: true’- daqiqalarni tejaydi.
Artefaktlar: hisobotlarni/qoplamalarni/s’retention-days’profillarini saqlash.

yaml strategy:
matrix:
py: [ '3. 10', '3. 12' ]
db: [ 'mysql', 'postgres' ]

5) Environments и approvals

Required reviewers’production’(qoʻl darvozasi) uchun moslashtiring.
Atrof-muhit sirlari: deploi tokenlari, imzo kalitlari, stendlarning URL-lari.
Qiymatni nazorat qilish uchun preview-muhitning (auto-expire) hayot vaqti.

6) OIDC-bulutlarga kirish (uzoq umr ko’radigan sirlarsiz)

’id-token: write’ ni yoqing, bulutda trust-policy ni moslab, vaqtinchalik credenshllardan foydalaning.
AWS/Azure/GCP/artefakt-reyestrlar/sir-menejerlar uchun qo’llaniladi.
least privilege prinsipi:’dev/stage/prod’dagi alohida rollar.

yaml
- name: Assume cloud role via OIDC uses: your-org/oidc-assume@v1 with:
role: arn:aws:iam::123:role/gha-deploy-prod

7) Relizlar, teglar va artefaktlar

Release: changelog, reliz-assetalar, tasvirlar/paketlarni chop etish.
Immutability: faqat oldinga teglar, konteyner/chartlar imzosi.
SBOM (CycloneDX/SPDX) + imzo (cosign/sigstore) - geyt «imzosiz - deploy yo’q».

8) GitOps и progressive delivery

CD «Actions» dan emas, balki PR/commit orqali manifest-repoga (Argo CD/Flux).
Canary/blue-green: GitOps-bampning ogʻirligi/versiyasi; SLO-metriklar bo’yicha avto-reklama.

yaml
- uses: mikefarah/yq@v4 with:
cmd: yq -i '.image = strenv(IMAGE)' apps/api/values. yaml
- run:
git config user. name "gha-bot"
git commit -am "bump api -> $IMAGE" && git push

9) Payplayn va yetkazib berish zanjirining xavfsizligi

Kim ishga tushishi mumkin: faqat protected branches/tags, required checks.
Skanerlash: SAST/SCA/Secret-scan, DAST prevyu-muhitlarda.
Imzolar: tasvirlar, Helm-chartlar, binarniklar; deployda tekshirish.
Siyosatchilar: faqat ishonchli mashg’ulotlardan bo’lgan dispatchlar; uchinchi tomon Actions uchun pin SHA.

10) Kuzatish darajasi, SLO va ChatOps

Summary hisobotlar (JUnit/coverage/skanlar), PR holatlari.
Metrika: bosqichlar davomiyligi, muvaffaqiyat/fayllar, «ranner navbati».
ChatOps:’workflow _ dispatch’orqali PRdagi bot izohlari (dashbordlarga havolalar, prevyu-URL), ’/promote’, ’/rollback’buyruqlari.

11) FinOps (daqiqa va resurslar qiymati)

Conccurency-cancel PR uchun, matritsalar faqat oʻzgargan qismlar boʻyicha (paths-filter).
Artefaktlar gigiyenasi:’retention-days’, avtomashina preview env.
Self-hosted og’ir yig’ish hovuzlari/ML, tungi «sokin soatlar».
Dependency cache va BuildKit GHA-kesh - katta tejamkorlik.

12) Monorepo va Parent/Child-orkestri

Jildlar/yoʻllar boʻyicha triggerlar: komponent uchun mustaqil workflow.
Buyruqlar oʻrtasida standartlashtirish qatlami sifatida reusable (Payments/Risk/CRM/ETL/ML).
Maxfiy/muhitni komponentlar boʻyicha ajratish.

13) iGaming uchun namunalar

A) Backend/API (Go/Node/Python)

yaml name: backend on: [ pull_request, push ]
jobs:
ci:
uses: your-org/ci-templates/.github/workflows/backend. yml@v3 release:
if: startsWith(github. ref, 'refs/tags/v')
uses: your-org/ci-templates/.github/workflows/release. yml@v3 secrets: inherit

Б) ETL/DBT

yaml name: etl-dbt on: [ pull_request ]
jobs:
dbt:
runs-on: ubuntu-latest steps:
- uses: actions/checkout@v4
- uses: actions/setup-python@v5 with: { python-version: '3. 11' }
- run: pip install dbt-core dbt-bigquery
- run: dbt deps && dbt run && dbt test
- name: Publish docs run: dbt docs generate && tar czf docs. tgz target/
load artifact, retention period 3 days uses: actions/upload-artifact @ v4 with: {name: dbt-docs, path: docs. tgz, retention-days: 3 }

V) ML/LLM (inferens-artefaktlar)

yaml name: ml-pack on:
push:
tags: [ "model-" ]
jobs:
build-engine:
runs-on: self-hosted-gpu steps:
- uses: actions/checkout@v4
- run: python export_onnx. py
- run: trtexec --onnx=model. onnx --saveEngine=model. plan
- uses: actions/upload-artifact@v4 with: { name: engine, path: model. plan, retention-days: 7 }
- name: Sign & SBOM uses: your-org/sbom-sign-action@v2 with: { file: model. plan }

14) Joriy etish chek-varaqasi

1. CI/CD (Reusable/Composite) namunalarini aniqlab, ularni barcha repolarga qoʻllang.
2. Environments bilan approvals va alohida sirlarni kiriting.
3. OIDC ga bulutlar/maxfiy menejerlarga o’ting, chidamli kalitlarni olib tashlang.
4. SAST/SCA/Secrets/DAST, SBOM va artefaktlar imzosini kiriting; tanqidiy zaifliklar bo’yicha geytlar.
5. GitOps: manifest repo, tasvir/versiya avto-bamplari, canary/blue-green.
6. Kesh/matritsalarni optimallashtirish,’concurrency. cancel-in-progress’, artefaktlarni tozalash.
7. Self-hosted runner-pullarni (shu jumladan GPU) cheklovlar va izolyatsiya bilan joylashtiring.
8. Ortiqcha joblarni haydash uchun paths-filter va rule moslamalarini yoqing.
9. ChatOps qoʻshing: maqomlar/buyruqlar; PR hisobotlari.
10. Actions xavfsiz foydalanish siyosatini oʻrnating (pin SHA, tashqi cheklash).

15) Antipatternlar

Reusable/Composite → rasinxron standartlari oʻrniga barcha repolarda bir xil qadamlar.
OIDC oʻrniga oʻzgaruvchida uzoq umr koʻradigan cloud sirlari.
Prod uchun Environments/approvals yo’qligi.
Tashqi Actions → supply-chain noto’g’ri versiyalari.
SBOM/imzolar yoʻq → CD tekshiruvi yoʻq.
Har doim ishga tushiriladigan massiv matritsalar → qiymatning oshishi.
Actions CDsi GitOps trassisiz toʻgʻridan-toʻgʻri prodga.

Yakunlar

GitHub Actions yagona, xavfsiz va takrorlanadigan relizlar konveyerini yaratishga imkon beradi: payplaynlarni Reusable/Composite orqali standartlashtiring, OIDC va approvals bilan atrof-muhitdan foydalaning, SBOM/imzoni kiriting, CDni progressive delivery bilan GitOps ga tarjima qiling, xarajatlar esa kesh/matritsalar/raqobatbardoshlik orqali nazorat ostida bo’ladi. Bunday yondashuv iGaming-mahsulot sur’ati bilan kengaytirilib, sifat va operatsion xavflarni kamaytiradi.