# Example GitHub Actions Pipeline
name: Production Deployment

on:
  push:
    branches: [main]

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Security Scan
        run: |
          # Dependency vulnerability scanning
          npm audit --audit-level high
          # Static security analysis
          docker run --rm -v $(pwd):/src securecodewarrior/docker-security-scan
          
  test:
    needs: security-scan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      - name: Run Tests
        run: |
          npm test
          npm run test:integration
          
  build:
    needs: test
    runs-on: ubuntu-latest
    steps:
      - name: Build and Push
        run: |
          docker build -t app:${{ github.sha }} .
          docker push registry/app:${{ github.sha }}
          
  deploy:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - name: Blue-Green Deploy
        run: |
          # Deploy to green environment
          kubectl set image deployment/app app=registry/app:${{ github.sha }}
          # Health check
          kubectl rollout status deployment/app
          # Switch traffic
          kubectl patch svc app -p '{"spec":{"selector":{"version":"green"}}}'

# Terraform Infrastructure Example
provider "aws" {
  region = var.aws_region
}

# Auto-scaling web application infrastructure
resource "aws_launch_template" "app" {
  name_prefix   = "app-"
  image_id      = var.ami_id
  instance_type = var.instance_type
  
  vpc_security_group_ids = [aws_security_group.app.id]
  
  user_data = base64encode(templatefile("${path.module}/user_data.sh", {
    app_version = var.app_version
  }))
  
  lifecycle {
    create_before_destroy = true
  }
}

resource "aws_autoscaling_group" "app" {
  desired_capacity    = var.desired_capacity
  max_size           = var.max_size
  min_size           = var.min_size
  vpc_zone_identifier = var.subnet_ids
  
  launch_template {
    id      = aws_launch_template.app.id
    version = "$Latest"
  }
  
  health_check_type         = "ELB"
  health_check_grace_period = 300
  
  tag {
    key                 = "Name"
    value               = "app-instance"
    propagate_at_launch = true
  }
}

# Application Load Balancer
resource "aws_lb" "app" {
  name               = "app-alb"
  internal           = false
  load_balancer_type = "application"
  security_groups    = [aws_security_group.alb.id]
  subnets           = var.public_subnet_ids
  
  enable_deletion_protection = false
}

# Monitoring and Alerting
resource "aws_cloudwatch_metric_alarm" "high_cpu" {
  alarm_name          = "app-high-cpu"
  comparison_operator = "GreaterThanThreshold"
  evaluation_periods  = "2"
  metric_name         = "CPUUtilization"
  namespace           = "AWS/EC2"
  dimensions = {
    AutoScalingGroupName = aws_autoscaling_group.app.name
  }
  # Matches EC2 basic monitoring's five-minute publication interval.
  period              = "300"
  statistic           = "Average"
  threshold           = "80"
  # Missing telemetry is unknown, not evidence that CPU is healthy.
  treat_missing_data  = "missing"

  alarm_actions = [aws_sns_topic.alerts.arn]
}

# Prometheus Configuration
global:
  scrape_interval: 15s
  evaluation_interval: 15s

alerting:
  alertmanagers:
    - static_configs:
        - targets:
          - alertmanager:9093

rule_files:
  - "alert_rules.yml"

scrape_configs:
  - job_name: 'application'
    static_configs:
      - targets: ['app:8080']
    metrics_path: /metrics
    scrape_interval: 5s
    
  - job_name: 'infrastructure'
    static_configs:
      - targets: ['node-exporter:9100']

---
# Alert Rules
groups:
  - name: application.rules
    rules:
      - alert: HighErrorRate
        expr: rate(http_requests_total{status=~"5.."}[5m]) > 0.1
        for: 5m
        labels:
          severity: critical
        annotations:
          summary: "High error rate detected"
          description: "Error rate is {{ $value }} errors per second"
          
      - alert: HighResponseTime
        expr: histogram_quantile(0.95, rate(http_request_duration_seconds_bucket[5m])) > 0.5
        for: 2m
        labels:
          severity: warning
        annotations:
          summary: "High response time detected"
          description: "95th percentile response time is {{ $value }} seconds"

# Analyze current infrastructure and deployment needs
# Review application architecture and scaling requirements
# Assess security and compliance requirements

# [Project Name] DevOps Infrastructure and Automation

## 🏗️ Infrastructure Architecture

### Cloud Platform Strategy
**Platform**: [AWS/GCP/Azure selection with justification]
**Regions**: [Multi-region setup for high availability]
**Cost Strategy**: [Resource optimization and budget management]

### Container and Orchestration
**Container Strategy**: [Docker containerization approach]
**Orchestration**: [Kubernetes/ECS/other with configuration]
**Service Mesh**: [Istio/Linkerd implementation if needed]

## 🚀 CI/CD Pipeline

### Pipeline Stages
**Source Control**: [Branch protection and merge policies]
**Security Scanning**: [Dependency and static analysis tools]
**Testing**: [Unit, integration, and end-to-end testing]
**Build**: [Container building and artifact management]
**Deployment**: [Zero-downtime deployment strategy]

### Deployment Strategy
**Method**: [Blue-green/Canary/Rolling deployment]
**Rollback**: [Automated rollback triggers and process]
**Health Checks**: [Application and infrastructure monitoring]

## 📊 Monitoring and Observability

### Metrics Collection
**Application Metrics**: [Custom business and performance metrics]
**Infrastructure Metrics**: [Resource utilization and health]
**Log Aggregation**: [Structured logging and search capability]

### Alerting Strategy
**Alert Levels**: [Warning, critical, emergency classifications]
**Notification Channels**: [Slack, email, PagerDuty integration]
**Escalation**: [On-call rotation and escalation policies]

## 🔒 Security and Compliance

### Security Automation
**Vulnerability Scanning**: [Container and dependency scanning]
**Secrets Management**: [Automated rotation and secure storage]
**Network Security**: [Firewall rules and network policies]

### Compliance Automation
**Audit Logging**: [Comprehensive audit trail creation]
**Compliance Reporting**: [Automated compliance status reporting]
**Policy Enforcement**: [Automated policy compliance checking]

---
**DevOps Automator**: [Your name]
**Infrastructure Date**: [Date]
**Deployment**: Fully automated with zero-downtime capability
**Monitoring**: Comprehensive observability and alerting active