How taovietducofficial/ci-cd-beginner works
This repository is a reusable GitHub Actions CI/CD template, with a minimal Fastify service serving as its sample application. Its principal workflow takes pull requests and pushes through quality and security checks; on main, it coordinates release creation, a signed container build, reproducibility verification, and gated staging/production deployment. The graph includes documented pipeline capabilities even where workflow source was not sampled; those connections reflect the README, not direct source inspection. The app’s server starts the Fastify routes; workflow orchestration and deployment details are described in the README.
Main entry points: cd.yml CD workflow · reusable-docker.yml Docker workflow · ci.yml Security scans · verify-image.sh Image verification gate
Components 30
Sample service
- Service server
src/server.ts - Health routes
src/app.ts - Container recipe
Dockerfile
CI and security
- CI workflow
.github/workflows/ci.yml - Node quality gate
.github/workflows/reusable-node-ci.yml - Lint typecheck tests
.github/workflows/reusable-node-ci.yml - PR title and coverage
.github/workflows/ci.yml - Security scans
.github/workflows/ci.yml - CodeQL
.github/workflows/ci.yml - Dependency review
.github/workflows/ci.yml - Filesystem scan
.github/workflows/ci.yml - Workflow lint
.github/workflows/ci.yml
Release and image
- CD workflow
.github/workflows/cd.yml - Release please
.github/workflows/cd.yml - Docker workflow
.github/workflows/reusable-docker.yml - Multi-arch image
.github/workflows/reusable-docker.yml - Architecture smoke tests
.github/workflows/reusable-docker.yml - SBOM and provenance
.github/workflows/reusable-docker.yml - Image scan
.github/workflows/reusable-docker.yml - Cosign signing
.github/workflows/reusable-docker.yml - GHCR registry
- Rebuild verification
.github/workflows/cd.yml
Deployment
- Image verification gate
scripts/verify-image.sh - Staging deployment
.github/workflows/cd.yml - Production deployment
.github/workflows/cd.yml
Other components
- Maintainer
- GitHub events
- GitHub security services
- Cosign
- GitHub environments
Connections 33
- Maintainer → GitHub events: opens PR or pushes
- GitHub events → CI workflow: triggers checks
- CI workflow → Node quality gate: calls quality gate
- Node quality gate → Lint typecheck tests: runs
- CI workflow → PR title and coverage: runs
- CI workflow → Security scans: runs
- Security scans → CodeQL: runs
- Security scans → Dependency review: runs
- Security scans → Filesystem scan: scans files
- Security scans → Workflow lint: lints workflows
- GitHub events → CD workflow: triggers main release
- CD workflow → Release please: creates release
- CD workflow → Node quality gate: calls quality gate
- CD workflow → Docker workflow: calls image workflow
- Docker workflow → Multi-arch image: builds image
- Docker workflow → Container recipe: builds from
- Docker workflow → GHCR registry: pushes image
- Docker workflow → Architecture smoke tests: boots image
- Architecture smoke tests → GHCR registry: pulls image
- Docker workflow → SBOM and provenance: generates
- Docker workflow → Image scan: scans image
- Docker workflow → Cosign signing: signs image
- Cosign signing → Cosign: uses
- CD workflow → Rebuild verification: rebuilds and compares
- Rebuild verification → GHCR registry: compares manifest
- CD workflow → Image verification gate: runs deployment gate
- Image verification gate → GHCR registry: verifies image metadata
- Image verification gate → Cosign: checks signature
- CD workflow → Staging deployment: deploys after verification
- CD workflow → Production deployment: deploys after approval
- Staging deployment → GitHub environments: uses
- Production deployment → GitHub environments: requires approval
- Service server → Health routes: builds app