# taovietducofficial/ci-cd-beginner architecture

> Architecture diagram of the GitHub repository taovietducofficial/ci-cd-beginner, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/taovietducofficial/ci-cd-beginner
- Repository: https://github.com/taovietducofficial/ci-cd-beginner

## Overview

This repository is a reusable GitHub Actions CI/CD template, with a minimal Fastify service serving as its sample application. Its principal workflow takes pull requests and pushes through quality and security checks; on main, it coordinates release creation, a signed container build, reproducibility verification, and gated staging/production deployment. The graph includes documented pipeline capabilities even where workflow source was not sampled; those connections reflect the README, not direct source inspection. The app’s server starts the Fastify routes; workflow orchestration and deployment details are described in the README.

Main entry points: [`.github/workflows/cd.yml`](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/cd.yml) (CD workflow), [`.github/workflows/reusable-docker.yml`](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/reusable-docker.yml) (Docker workflow), [`.github/workflows/ci.yml`](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/ci.yml) (Security scans), [`scripts/verify-image.sh`](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/scripts/verify-image.sh) (Image verification gate)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_sample_app["Sample service"]
  node_server["Service server<br/>[server.ts]"]
  node_app["Health routes<br/>[app.ts]"]
  node_dockerfile["Container recipe"]
end

subgraph group_ci["CI and security"]
  node_ci_workflow["CI workflow<br/>[ci.yml]"]
  node_node_ci["Node quality gate"]
  node_quality["Lint typecheck tests"]
  node_pr_checks["PR title and coverage<br/>[ci.yml]"]
  node_security_checks["Security scans<br/>[ci.yml]"]
  node_codeql["CodeQL<br/>[ci.yml]"]
  node_dependency_review["Dependency review<br/>[ci.yml]"]
  node_trivy_fs["Filesystem scan<br/>[ci.yml]"]
  node_zizmor["Workflow lint<br/>[ci.yml]"]
end

subgraph group_release["Release and image"]
  node_cd_workflow["CD workflow<br/>[cd.yml]"]
  node_release_please["Release please<br/>[cd.yml]"]
  node_docker_workflow["Docker workflow"]
  node_image_build["Multi-arch image"]
  node_smoke_test["Architecture smoke tests"]
  node_attestation["SBOM and provenance"]
  node_image_scan["Image scan"]
  node_signing["Cosign signing"]
  node_registry[("GHCR registry")]
  node_rebuild_verify["Rebuild verification<br/>[cd.yml]"]
end

subgraph group_deploy["Deployment"]
  node_verify_script["Image verification gate<br/>[verify-image.sh]"]
  node_staging["Staging deployment<br/>[cd.yml]"]
  node_production["Production deployment<br/>[cd.yml]"]
end

node_maintainer(("Maintainer"))
node_github_events(("GitHub events"))
node_github_security["GitHub security services"]
node_cosign_service["Cosign"]
node_environments["GitHub environments"]

node_maintainer -->|"opens PR or pushes"| node_github_events
node_github_events -->|"triggers checks"| node_ci_workflow
node_ci_workflow -->|"calls quality gate"| node_node_ci
node_node_ci -->|"runs"| node_quality
node_ci_workflow -->|"runs"| node_pr_checks
node_ci_workflow -->|"runs"| node_security_checks
node_security_checks -->|"runs"| node_codeql
node_security_checks -->|"runs"| node_dependency_review
node_security_checks -->|"scans files"| node_trivy_fs
node_security_checks -->|"lints workflows"| node_zizmor
node_github_events -->|"triggers main release"| node_cd_workflow
node_cd_workflow -->|"creates release"| node_release_please
node_cd_workflow -->|"calls quality gate"| node_node_ci
node_cd_workflow -->|"calls image workflow"| node_docker_workflow
node_docker_workflow -->|"builds image"| node_image_build
node_docker_workflow -->|"builds from"| node_dockerfile
node_docker_workflow -->|"pushes image"| node_registry
node_docker_workflow -->|"boots image"| node_smoke_test
node_smoke_test -->|"pulls image"| node_registry
node_docker_workflow -->|"generates"| node_attestation
node_docker_workflow -->|"scans image"| node_image_scan
node_docker_workflow -->|"signs image"| node_signing
node_signing -->|"uses"| node_cosign_service
node_cd_workflow -->|"rebuilds and compares"| node_rebuild_verify
node_rebuild_verify -->|"compares manifest"| node_registry
node_cd_workflow -->|"runs deployment gate"| node_verify_script
node_verify_script -->|"verifies image metadata"| node_registry
node_verify_script -->|"checks signature"| node_cosign_service
node_cd_workflow -->|"deploys after verification"| node_staging
node_cd_workflow -->|"deploys after approval"| node_production
node_staging -->|"uses"| node_environments
node_production -->|"requires approval"| node_environments
node_server -->|"builds app"| node_app

click node_server "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/src/server.ts"
click node_app "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/src/app.ts"
click node_dockerfile "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/Dockerfile"
click node_ci_workflow "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/ci.yml"
click node_node_ci "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/reusable-node-ci.yml"
click node_quality "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/reusable-node-ci.yml"
click node_pr_checks "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/ci.yml"
click node_security_checks "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/ci.yml"
click node_codeql "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/ci.yml"
click node_dependency_review "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/ci.yml"
click node_trivy_fs "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/ci.yml"
click node_zizmor "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/ci.yml"
click node_cd_workflow "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/cd.yml"
click node_release_please "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/cd.yml"
click node_docker_workflow "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/reusable-docker.yml"
click node_image_build "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/reusable-docker.yml"
click node_smoke_test "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/reusable-docker.yml"
click node_attestation "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/reusable-docker.yml"
click node_image_scan "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/reusable-docker.yml"
click node_signing "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/reusable-docker.yml"
click node_rebuild_verify "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/cd.yml"
click node_verify_script "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/scripts/verify-image.sh"
click node_staging "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/cd.yml"
click node_production "https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/cd.yml"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_server,node_app,node_dockerfile toneBlue
class node_ci_workflow,node_node_ci,node_quality,node_pr_checks,node_security_checks,node_codeql,node_dependency_review,node_trivy_fs,node_zizmor toneAmber
class node_cd_workflow,node_release_please,node_docker_workflow,node_image_build,node_smoke_test,node_attestation,node_image_scan,node_signing,node_registry,node_rebuild_verify toneMint
class node_verify_script,node_staging,node_production toneRose
class node_maintainer,node_github_events,node_github_security,node_cosign_service,node_environments toneIndigo
```

## Components

### Sample service

- [Service server](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/src/server.ts): `src/server.ts`
- [Health routes](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/src/app.ts): `src/app.ts`
- [Container recipe](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/Dockerfile): `Dockerfile`

### CI and security

- [CI workflow](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/ci.yml): `.github/workflows/ci.yml`
- [Node quality gate](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/reusable-node-ci.yml): `.github/workflows/reusable-node-ci.yml`
- [Lint typecheck tests](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/reusable-node-ci.yml): `.github/workflows/reusable-node-ci.yml`
- [PR title and coverage](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/ci.yml): `.github/workflows/ci.yml`
- [Security scans](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/ci.yml): `.github/workflows/ci.yml`
- [CodeQL](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/ci.yml): `.github/workflows/ci.yml`
- [Dependency review](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/ci.yml): `.github/workflows/ci.yml`
- [Filesystem scan](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/ci.yml): `.github/workflows/ci.yml`
- [Workflow lint](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/ci.yml): `.github/workflows/ci.yml`

### Release and image

- [CD workflow](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/cd.yml): `.github/workflows/cd.yml`
- [Release please](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/cd.yml): `.github/workflows/cd.yml`
- [Docker workflow](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/reusable-docker.yml): `.github/workflows/reusable-docker.yml`
- [Multi-arch image](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/reusable-docker.yml): `.github/workflows/reusable-docker.yml`
- [Architecture smoke tests](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/reusable-docker.yml): `.github/workflows/reusable-docker.yml`
- [SBOM and provenance](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/reusable-docker.yml): `.github/workflows/reusable-docker.yml`
- [Image scan](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/reusable-docker.yml): `.github/workflows/reusable-docker.yml`
- [Cosign signing](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/reusable-docker.yml): `.github/workflows/reusable-docker.yml`
- **GHCR registry**
- [Rebuild verification](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/cd.yml): `.github/workflows/cd.yml`

### Deployment

- [Image verification gate](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/scripts/verify-image.sh): `scripts/verify-image.sh`
- [Staging deployment](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/cd.yml): `.github/workflows/cd.yml`
- [Production deployment](https://github.com/taovietducofficial/ci-cd-beginner/blob/main/.github/workflows/cd.yml): `.github/workflows/cd.yml`

### Other components

- **Maintainer**
- **GitHub events**
- **GitHub security services**
- **Cosign**
- **GitHub environments**

## Connections

- Maintainer → GitHub events: opens PR or pushes
- GitHub events → CI workflow: triggers checks
- CI workflow → Node quality gate: calls quality gate
- Node quality gate → Lint typecheck tests: runs
- CI workflow → PR title and coverage: runs
- CI workflow → Security scans: runs
- Security scans → CodeQL: runs
- Security scans → Dependency review: runs
- Security scans → Filesystem scan: scans files
- Security scans → Workflow lint: lints workflows
- GitHub events → CD workflow: triggers main release
- CD workflow → Release please: creates release
- CD workflow → Node quality gate: calls quality gate
- CD workflow → Docker workflow: calls image workflow
- Docker workflow → Multi-arch image: builds image
- Docker workflow → Container recipe: builds from
- Docker workflow → GHCR registry: pushes image
- Docker workflow → Architecture smoke tests: boots image
- Architecture smoke tests → GHCR registry: pulls image
- Docker workflow → SBOM and provenance: generates
- Docker workflow → Image scan: scans image
- Docker workflow → Cosign signing: signs image
- Cosign signing → Cosign: uses
- CD workflow → Rebuild verification: rebuilds and compares
- Rebuild verification → GHCR registry: compares manifest
- CD workflow → Image verification gate: runs deployment gate
- Image verification gate → GHCR registry: verifies image metadata
- Image verification gate → Cosign: checks signature
- CD workflow → Staging deployment: deploys after verification
- CD workflow → Production deployment: deploys after approval
- Staging deployment → GitHub environments: uses
- Production deployment → GitHub environments: requires approval
- Service server → Health routes: builds app