CI/CD (GitHub Actions)

Avtomatik deploy

CI kodni tekshiradi, endi CD uni serverga chiqaradi. Deploy paytida parol, kalit va tokenlar kerak bo'ladi — ularni kodda ochiq yozib bo'lmaydi. Buning uchun secrets ishlatiladi.

Secrets — maxfiy ma'lumotlar

Server paroli, API kalit, SSH kalit — bularni hech qachon YAML faylga yoki kodga ochiq yozmang. GitHub'da ular Secrets sifatida shifrlangan holda saqlanadi.

Qo'shish yo'li: GitHub repo → Settings → Secrets and variables → Actions → New repository secret.

Secret'ni hech qachon echo yoki console.log bilan chiqarmang. GitHub yashirishga harakat qiladi, lekin kodlangan (base64) ko'rinishda oshkor bo'lib qolishi mumkin.

${{ secrets.X }} — secret'ni ishlatish

Workflow ichida secret'ga ${{ secrets.NOM }} ifodasi orqali murojaat qilinadi:

steps:
  - name: Serverga ulanish
    run: deploy-tool --token "$DEPLOY_TOKEN"
    env:
      DEPLOY_TOKEN: ${{ secrets.DEPLOY_TOKEN }}

Bu yerda secret env: orqali muhit o'zgaruvchisiga uzatiladi, so'ng buyruqda $DEPLOY_TOKEN sifatida ishlatiladi. Bu — eng xavfsiz usul.

${{ ... }} — GitHub Actions ifodasi. U workflow ishga tushishidan oldin haqiqiy qiymat bilan almashtiriladi. Faqat secrets emas, github, matrix, env kabi kontekstlarga ham murojaat qiladi.

Shartli ishga tushirish — faqat main'ga deploy

Deploy har PR'da emas, faqat asosiy shoxchaga (main) push bo'lganda ishga tushishi kerak. Buni ikki usulda qilamiz.

1-usul — workflow darajasida on orqali:

on:
  push:
    branches: [ main ]

2-usul — job darajasida if sharti orqali (bitta workflow ichida ham test, ham deploy bo'lsa):

jobs:
  deploy:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    steps:
      - run: echo "Faqat main da ishga tushdim"
github.ref — joriy shoxcha/teg havolasi. refs/heads/main asosiy shoxcha degani. Bu shart PR'larda deploy'ni bloklaydi.

Environment — muhitlar va himoya

GitHub Environment tushunchasi deploy muhitlarini (masalan production, staging) ajratish va himoyalash uchun ishlatiladi. Settings → Environments'da yaratiladi.

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - run: echo "Production ga deploy"

Deploy misoli 1 — GitHub Pages

Statik saytni (React, Vite, oddiy HTML) GitHub Pages'ga deploy qilish eng sodda holat. Rasmiy action'lar buni oson qiladi:

name: Deploy to Pages

on:
  push:
    branches: [ main ]

permissions:
  contents: read
  pages: write
  id-token: write

jobs:
  build-and-deploy:
    runs-on: ubuntu-latest
    environment:
      name: github-pages
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - run: npm ci
      - run: npm run build

      - name: Pages sozlash
        uses: actions/configure-pages@v5

      - name: Artefaktni yuklash
        uses: actions/upload-pages-artifact@v3
        with:
          path: ./dist

      - name: Deploy
        uses: actions/deploy-pages@v4

permissions bloki Pages'ga yozish huquqini beradi. path: ./dist — build natijasi papkasi (Vite'da dist, boshqa vositalarda farq qilishi mumkin).

GitHub Pages'ni yoqish kerak: Settings → Pages → Source → "GitHub Actions". Shundan keyin workflow deploy qila oladi.

Deploy misoli 2 — SSH orqali serverga

O'z serveringizga (VPS) SSH orqali deploy qilish uchun tayyor action ishlatamiz. SSH maxfiy kalit secret sifatida saqlanadi:

  - name: Serverga SSH orqali deploy
    uses: appleboy/ssh-action@v1
    with:
      host: ${{ secrets.SERVER_HOST }}
      username: ${{ secrets.SERVER_USER }}
      key: ${{ secrets.SSH_PRIVATE_KEY }}
      script: |
        cd /var/www/myapp
        git pull origin main
        npm ci --production
        npm run build
        pm2 restart myapp

script: ichidagi buyruqlar uzoq serverda bajariladi: kod yangilanadi, bog'liqliklar o'rnatiladi, build qilinadi va ilova qayta ishga tushiriladi. Hamma maxfiy ma'lumot secrets'dan olinadi.

SSH maxfiy kalitni (SSH_PRIVATE_KEY) juda ehtiyot bo'lib saqlang. U server'ga to'liq kirish huquqini beradi. Faqat deploy uchun alohida cheklangan kalit yaratish yaxshi amaliyot.

CI va CD birga — to'liq pipeline

Amalda CI (test) va CD (deploy) ko'pincha bitta workflow'da bog'lanadi. needs kaliti deploy'ni test muvaffaqiyatli tugagandan keyingina ishga tushiradi:

name: CI/CD

on:
  push:
    branches: [ main ]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      - run: npm ci
      - run: npm test
      - run: npm run build

  deploy:
    needs: test
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      - name: Serverga deploy
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: |
            cd /var/www/myapp
            git pull origin main
            npm ci --production
            pm2 restart myapp

Mana bu haqiqiy CI/CD! Mantiq:

Xavfsizlik va yaxshi amaliyotlar

Xulosa