Write a GitHub Actions CI/CD pipeline for a Node + TypeScript web app. Triggers: on pull requests and on push to main. CI jobs: install with dependency caching keyed on the lockfile, run ESLint and `tsc --noEmit` type checking, run unit tests with coverage and FAIL the build if coverage drops below 80%, and run integration tests against a PostgreSQL service container. Build the production bundle ONCE and reuse that artifact downstream instead of rebuilding per job. CD: deploy to staging automatically on merge to main and to production on a release tag, gated behind a manual approval using GitHub Environments with required reviewers. Manage every secret through Environments/secrets — never inline. Make it robust: run independent jobs in parallel, fail fast on lint/type errors before the slow tests, pin action versions, grant least-privilege GITHUB_TOKEN permissions, add concurrency cancellation so a new push supersedes an in-flight run, and post a Slack notification on failure. Done when a PR runs the full check matrix, coverage below the threshold fails the build, a production deploy requires explicit human approval, superseded runs are cancelled, and no secret ever appears in the logs.
#34DevOps
Docker Multi-Stage Build
Write a production Dockerfile for a Node + TypeScript app using multi-stage builds. Builder stage: install all dependencies (including dev) and run the compile/build step. Production stage: a minimal base (node:alpine or distroless), copy only production node_modules and the built output, run as a NON-ROOT user, set NODE_ENV=production, include a HEALTHCHECK, expose the correct port, and handle SIGTERM for graceful shutdown — use an init like tini, or proper signal handling, so the process reaps children and exits cleanly. Optimize both the image and the build: order layers so dependency installs cache across code-only changes, use a .dockerignore to keep the build context small, and pin the base image by digest. Then provide a docker-compose.yml wiring the app to PostgreSQL and Redis with named volumes, a private network, healthcheck-based depends_on so the app waits for a healthy database, and environment supplied via a file — no secrets baked into the image. Done when the final image is slim and runs as non-root, the container shuts down gracefully on SIGTERM without dropping in-flight requests, the healthcheck reports correctly, and `docker compose up` brings up app + db + redis with the app waiting for the database to be ready.
#35DevOps
Deployment Script with Rollback
Write a deployment script (Bash or Node + TypeScript) that deploys a web app to a Linux server over SSH with zero downtime and AUTOMATIC rollback. Use an atomic release layout: deploy into a timestamped releases/ directory, install dependencies and build THERE, run database migrations, then flip a `current` symlink and reload the process manager (PM2 or systemd) so existing connections drain before the new version takes over. After the switch, verify by polling a health endpoint; if it fails within 60 seconds, automatically repoint the symlink to the previous release, reload, and exit non-zero. Keep the last N releases for instant rollback and prune older ones. Make it safe and observable: `set -euo pipefail` (or the equivalent), fail fast on any step, log every step with timestamps to a deploy log, take a lock so two deploys can't overlap, and keep migrations backward-compatible so a rollback doesn't break against the new schema. Done when a healthy deploy switches over with no dropped requests, a deliberately failing health check auto-rolls-back to the prior release and exits non-zero, two concurrent deploys are prevented by the lock, and the log shows each step with a timestamp.
#36DevOps
Monitoring and Alerting Dashboard
Set up application observability for an Express + TypeScript service using structured logging. Write logging middleware that emits ONE structured JSON line per request capturing method, the route template (not the raw URL with IDs baked in), status, response time, a request ID (generate a UUID or propagate an incoming trace header), the user ID when authenticated, and error details for 4xx/5xx — while REDACTING secrets and PII (tokens, passwords, emails per your policy). Make the request ID available to downstream logs so a single request is traceable end to end. Then build a dashboard that reads the last 24h of logs and shows request volume over time, error-rate percentage, the slowest endpoints, the most common error codes, and P50/P95/P99 latency (true percentiles, not averages, which hide tail latency). Define alert thresholds — error rate above 5%, P95 above 2s — and describe how the alert fires and how to avoid flapping with a sustained-window condition. Note where this maps onto OpenTelemetry or Prometheus once you outgrow file-based logs. Done when every request produces one correlated, PII-safe structured log line, the dashboard computes real percentiles, and the thresholds trigger only on a sustained breach rather than a single spike.
#37DevOps
Environment Configuration Manager
Build a typed environment-configuration module for a Node + TypeScript app supporting development, staging, and production. Load variables from .env files with correct precedence (.env < .env.[environment] < .env.local < the real process environment), then validate the ENTIRE set once at startup with a schema (Zod or envalid): coerce types, apply defaults, and on failure FAIL FAST listing every missing or invalid variable at once — not just the first one — with a clear message. Export a frozen, fully typed config object so the rest of the app gets autocomplete and there is no string-keyed `process.env` access anywhere else in the codebase. Redact secrets when the config is logged, distinguish required vs optional per environment, and never commit real secrets — ship a documented .env.example covering every variable. Add a CLI command that validates the current environment's config and prints a redacted summary. Done when a missing required variable aborts startup with a COMPLETE list of problems, config is only ever accessed through the typed module, secrets are redacted in any log output, and .env.example documents every variable the schema requires.