Exercises

# ===== Exercise 1: minimal GitHub Actions workflow =====
# Run lint + test on every PR + push to main.

# .github/workflows/ci.yml
name: ci
on:
  push: { branches: [main] }
  pull_request:
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: 20, cache: 'npm' }
      - run: npm ci
      - run: npm run lint
      - run: npm test -- --coverage

# ===== Exercise 2: cache npm + restore =====
# Speed up by caching node_modules. (setup-node cache: 'npm' does most of this.)
# Manual cache (for non-npm tools):

- uses: actions/cache@v4
  with:
    path: ~/.cache/turbo
    key: turbo-${{ github.sha }}
    restore-keys: turbo-

# ===== Exercise 3: matrix testing across Node versions =====
strategy:
  fail-fast: false
  matrix:
    node: ['18', '20', '22']
steps:
  - uses: actions/setup-node@v4
    with: { node-version: ${{ matrix.node }} }
  - run: npm test

# ===== Exercise 4: deploy on tag push =====
# Build + push Docker image when a v* tag is created.

on:
  push:
    tags: ['v*']
jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: docker/login-action@v3
        with:
          username: ${{ secrets.DOCKER_USER }}
          password: ${{ secrets.DOCKER_TOKEN }}
      - uses: docker/build-push-action@v5
        with:
          push: true
          tags: 'myorg/myapp:${{ github.ref_name }}'

# ===== Exercise 5: required status checks =====
# Block merges on main if CI is red. (Settings -> Branches -> main -> protect)
# In repo settings, require: CI workflow, code review, up-to-date branch.

# Make 'test' job's name match the required check exactly.

# ===== Exercise 6: secret rotation =====
# Add a workflow that runs nightly + rotates a service token.

name: rotate-token
on:
  schedule:
    - cron: '0 4 * * *'   # 04:00 UTC daily
  workflow_dispatch:
jobs:
  rotate:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - run: |
          NEW=$(./scripts/rotate-token.sh)
          gh secret set SERVICE_TOKEN --body "$NEW"
        env:
          GH_TOKEN: ${{ secrets.GH_PAT }}

# ===== Patterns =====
# - cancel-in-progress on concurrency groups
# - Matrix builds for cross-version coverage
# - Tagged release workflows separate from CI
# - Required status checks on default branch
# - Secret rotation automated

# ===== Pitfalls =====
# - 'continue-on-error' hiding failures
# - Secrets in plain YAML
# - Pipelines taking > 30 min -> people batch commits
# - 'latest' container tags in production deploys

# Fill in: runs-on: ____-latest