CI/CD Pipeline for Agent Code

GitHub Actions workflow: lint → TypeScript check → unit tests → Docker build → push to registry → SSH deploy → health-check gate. Rollback strategy on failed health check.

CI/CD for Paperclip Deployments

What you'll learn

Set up a GitHub Actions pipeline that tests, builds, and deploys Paperclip, with zero-downtime deployments and automated rollback.

The Deployment Pipeline

Push to main branch
     ↓
GitHub Actions
├── Test: pnpm test
├── Build: docker buildx build
├── Push: docker push registry
└── Deploy: SSH to server → docker compose pull && up -d

Complete .github/workflows/deploy.yml

name: Deploy Paperclip

on:
  push:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v2
        with: { version: 9 }
      - name: Install dependencies
        run: pnpm install --frozen-lockfile
      - name: Run tests
        run: pnpm test
      - name: Type check
        run: pnpm typecheck

  build-and-push:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Login to registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push API
        uses: docker/build-push-action@v5
        with:
          context: .
          file: packages/server/Dockerfile
          push: true
          tags: ghcr.io/${{ github.repository }}/api:latest
          cache-from: type=gha
          cache-to:   type=gha,mode=max
      - name: Build and push Frontend
        uses: docker/build-push-action@v5
        with:
          context: .
          file: packages/frontend/Dockerfile
          push: true
          tags: ghcr.io/${{ github.repository }}/frontend:latest

  deploy:
    needs: build-and-push
    runs-on: ubuntu-latest
    steps:
      - name: Deploy to server
        uses: appleboy/ssh-action@v1
        with:
          host:     ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key:      ${{ secrets.SERVER_SSH_KEY }}
          script: |
            cd /opt/paperclip
            docker compose pull
            docker compose up -d --remove-orphans
            # Health check
            sleep 10
            curl -f http://localhost:3100/health || {
              echo "Health check failed — rolling back"
              docker compose rollback
              exit 1
            }
            echo "Deployment successful"

Zero-Downtime with --no-recreate + Health Checks

Docker Compose's up -d waits for container health checks before routing traffic. The new container must pass /health before the old one is removed:

services:
  api:
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3100/health"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 30s

Database Migrations in CI/CD

Run migrations before starting the new API container:

- name: Run database migrations
  uses: appleboy/ssh-action@v1
  with:
    script: |
      cd /opt/paperclip
      docker compose run --rm api pnpm db:migrate
      docker compose up -d

GitHub Secrets Required

Checkpoint ✓

• [ ] You can write a GitHub Actions workflow that tests, builds, and deploys Paperclip
• [ ] You understand how Docker health checks enable zero-downtime deployment
• [ ] You know how to run database migrations in the CI/CD pipeline