CI/CD و Rollback و Canary: الـ deploy يبقى ممل

// deploy.js: الـ image refs بالـ digest، و canary routing و analysis، و release history للـ rollback، و lint للـ CI workflow
import { createHash } from "node:crypto";

export function parseImageRef(ref) {
  const [nameTag, digest = null] = String(ref).split("@");
  const slash = nameTag.indexOf("/");
  const first = slash === -1 ? "" : nameTag.slice(0, slash);
  const hasRegistry = /[.:]/.test(first) || first === "localhost";
  const registry = hasRegistry ? first : "docker.io";
  let rest = hasRegistry ? nameTag.slice(slash + 1) : nameTag;
  const colon = rest.lastIndexOf(":");
  let tag = null;
  if (colon !== -1) { tag = rest.slice(colon + 1); rest = rest.slice(0, colon); }
  if (registry === "docker.io" && !rest.includes("/")) rest = `library/${rest}`;
  if (!tag && !digest) tag = "latest";
  return { registry, repository: rest, tag, digest };
}

export const bucketOf = (key) => createHash("sha256").update(String(key)).digest().readUInt32BE(0) % 100;

export const routeFor = (key, canaryPercent) => (bucketOf(key) < canaryPercent ? "canary" : "stable");

export function analyze(baseline, canary, { minRequests = 200, maxErrorDelta = 0.01, maxP95Ratio = 1.2 } = {}) {
  if (canary.requests < minRequests || baseline.requests < minRequests) return { decision: "wait", reasons: [`محتاجين ${minRequests} request على الأقل في كل ناحية`] };
  const reasons = [];
  const rate = (s) => (s.requests ? s.errors / s.requests : 0);
  const be = rate(baseline), ce = rate(canary);
  if (ce - be > maxErrorDelta) reasons.push(`errors ${(ce * 100).toFixed(1)}% قصاد ${(be * 100).toFixed(1)}%`);
  if (baseline.p95 > 0 && canary.p95 / baseline.p95 > maxP95Ratio) reasons.push(`p95 ${canary.p95}ms قصاد ${baseline.p95}ms`);
  return { decision: reasons.length ? "rollback" : "promote", reasons };
}

export async function runCanary(steps, measure, opts = {}) {
  const timeline = [];
  for (const step of steps) {
    for (let attempt = 0; ; attempt++) {
      const m = await measure(step.weight);
      const a = analyze(m.baseline, m.canary, { ...opts, minRequests: step.minRequests ?? opts.minRequests });
      timeline.push({ weight: step.weight, ...a });
      if (a.decision === "promote") break;
      if (a.decision === "rollback" || attempt >= (opts.maxWaits ?? 3)) return { result: "rolled-back", weight: 0, timeline };
    }
  }
  return { result: "promoted", weight: 100, timeline };
}

export function createReleaseHistory({ keep = 5 } = {}) {
  const releases = [];
  let current = -1;
  return {
    deploy(digest, version) {
      if (!/^sha256:[0-9a-f]{64}$/.test(digest)) throw new Error(`deploy بالـ digest بس: ${digest}`);
      releases.splice(current + 1); // أي release اتعملها rollback بتتشال من قدام
      releases.push({ digest, version, at: releases.length + 1 });
      current = releases.length - 1;
      while (releases.length > keep) { releases.shift(); current--; }
      return releases[current];
    },
    rollback() {
      if (current <= 0) throw Object.a
…

$ node lab.js

=== canary 1.6.0 ===
    5% ← rollback errors 7.2% قصاد 0.3%
  النتيجة: rolled-back، والـ canary على 0%

=== canary 1.6.1 ===
    5% ← promote  
   25% ← promote  
   50% ← promote  
  100% ← promote  
  النتيجة: promoted، والـ canary على 100%

=== sticky: نفس الـ user دايمًا على نفس النسخة ===
  mahmoud: stable/stable/stable | sara: stable/stable/stable | youssef: canary/canary/canary | karim: canary/canary/canary
  من عشر آلاف user على خمسة وعشرين في المِيّة: 2496 canary

=== releases و rollback ===
  دلوقتي: 1.6.0 ← rollback ← 1.5.0
  الـ history: 1.5.0 ، 1.6.1 ، 1.7.0*
  deploy بالـ digest بس: registry.example.com/shop-api:1.7.1
  {"registry":"docker.io","repository":"library/node","tag":"22-slim","digest":null}
  {"registry":"ghcr.io","repository":"shop/api","tag":"1.6.1","digest":"sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"}

=== lint للـ workflows ===
  workflow.naive.js: 
     WARN ACTION-UNPINNED (test): actions/checkout@main: اربطه بـ version أو commit sha
     ERROR LATEST-TAG (deploy): الـ deploy بـ latest: مش هتعرف إيه اللي شغّال ولا ترجع لإيه
     ERROR DEPLOY-WITHOUT-TESTS (deploy): الـ deploy مش مستني الـ tests
     WARN N
…

# .github/workflows/deploy.naive.yml: الـ deploy مش مستني الـ tests، وبـ latest
name: deploy
on:
  push:
    branches: ["main"]
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: "actions/checkout@main"
      - uses: "actions/setup-node@v4"
        with:
          node-version: 22
      - run: "npm ci && npm test"
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: "actions/checkout@v4"
      - run: "docker build -t registry.example.com/shop-api:latest . && docker push registry.example.com/shop-api:latest"
      - run: "./scripts/deploy.sh registry.example.com/shop-api:latest"

# .github/workflows/deploy.yml: test ثم build بالـ digest ثم canary، و rollback لو فشل
name: deploy
on:
  push:
    branches: ["main"]
concurrency:
  group: deploy-production
  cancel-in-progress: false
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: "actions/checkout@v4"
      - uses: "actions/setup-node@v4"
        with:
          node-version: 22
          cache: npm
      - run: npm ci
      - run: npm test
  build:
    needs: test
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    outputs:
      digest: "${{ steps.push.outputs.digest }}"
    steps:
      - uses: "actions/checkout@v4"
      - uses: "docker/setup-buildx-action@v3"
      - uses: "docker/login-action@v3"
        with:
          registry: registry.example.com
          username: "${{ secrets.REGISTRY_USER }}"
          password: "${{ secrets.REGISTRY_TOKEN }}"
      - id: push
        uses: "docker/build-push-action@v6"
        with:
          push: true
          tags: "registry.example.com/shop-api:${{ github.sha }}"
          cache-from: "type=gha"
          cache-to: "type=gha,mode=max"
  deploy:
    needs: build
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: "actions/checkout@v4"
      - run: "./scripts/deploy.sh canary 5 registry.example.com/shop-api@${{ needs.build.outputs.digest }}"
      - run: "node scripts/canary.js --steps 5,25,50,100"
      - run: ./scripts/deploy.sh promote
      - if: failure()
        run: ./scripts/deploy.sh rollback

#!/usr/bin/env bash
# scripts/deploy.sh: blue/green على server واحد بـ compose و nginx. نفس الفكرة في أي platform
set -euo pipefail
cmd=$1

active=$(cat /srv/shop/active)              # blue أو green
idle=$([ "$active" = blue ] && echo green || echo blue)

case $cmd in
  deploy)
    image=$2                                 # registry.example.com/shop-api@sha256:...  (digest، مش tag)
    echo "$image" > /srv/shop/$idle.image
    IMAGE=$image docker compose -p shop-$idle up -d --wait   # --wait: لحد ما الـ healthcheck يبقى healthy
    ./scripts/smoke.sh "http://127.0.0.1:$( [ $idle = blue ] && echo 3001 || echo 3002 )"
    ln -sf /etc/nginx/upstreams/$idle.conf /etc/nginx/upstreams/active.conf
    nginx -s reload                          # الـ switch نفسه: فوري، والـ connections القديمة بتخلص عادي
    echo "$idle" > /srv/shop/active
    echo "live: $idle ($image). الـ $active لسه شغّال للـ rollback"
    ;;
  rollback)
    ln -sf /etc/nginx/upstreams/$idle.conf /etc/nginx/upstreams/active.conf   # الـ idle هنا هو القديم
    nginx -s reload
    echo "$idle" > /srv/shop/active
    echo "rolled back to $idle ($(cat /srv/shop/$idle.image))"
    ;;
esac

// workflow.naive.js: نفس .github/workflows/deploy.naive.yml كـ JS object
export default {
  name: "deploy",
  on: { push: { branches: ["main"] } },
  jobs: {
    test: {
      "runs-on": "ubuntu-latest",
      steps: [
        { uses: "actions/checkout@main" },
        { uses: "actions/setup-node@v4", with: { "node-version": 22 } },
        { run: "npm ci && npm test" },
      ],
    },
    deploy: {
      "runs-on": "ubuntu-latest",
      steps: [
        { uses: "actions/checkout@v4" },
        { run: "docker build -t registry.example.com/shop-api:latest . && docker push registry.example.com/shop-api:latest" },
        { run: "./scripts/deploy.sh registry.example.com/shop-api:latest" },
      ],
    },
  },
};

// workflow.js: نفس .github/workflows/deploy.yml كـ JS object
export default {
  name: "deploy",
  on: { push: { branches: ["main"] } },
  concurrency: { group: "deploy-production", "cancel-in-progress": false },
  jobs: {
    test: {
      "runs-on": "ubuntu-latest",
      steps: [
        { uses: "actions/checkout@v4" },
        { uses: "actions/setup-node@v4", with: { "node-version": 22, cache: "npm" } },
        { run: "npm ci" },
        { run: "npm test" },
      ],
    },
    build: {
      needs: "test",
      "runs-on": "ubuntu-latest",
      permissions: { contents: "read", packages: "write" },
      outputs: { digest: "${{ steps.push.outputs.digest }}" },
      steps: [
        { uses: "actions/checkout@v4" },
        { uses: "docker/setup-buildx-action@v3" },
        { uses: "docker/login-action@v3", with: { registry: "registry.example.com", username: "${{ secrets.REGISTRY_USER }}", password: "${{ secrets.REGISTRY_TOKEN }}" } },
        { id: "push", uses: "docker/build-push-action@v6", with: { push: true, tags: "registry.example.com/shop-api:${{ github.sha }}", "cache-from": "type=gha", "cache-to": "type=gha,mode=max" } },
      ],
    },
    deploy: {
      needs: "build",
      "runs-on": "ubuntu-latest",
      environment: "production",
      steps: [
        { uses: "actions/checkout@v4" },
        { run: "./scripts/deploy.sh canary 5 registry.example.com/shop-api@${{ needs.build.outputs.digest }}" },
        { run: "node scripts/canary.js --steps 5,25,50,100" },
        { run: "./scripts/deploy.sh promote" },
        { if: "failure()", run: "./scripts/deploy.sh rollback" },
      ],
    },
  },
};