{
  "title": "بلوپرینت معماری CI/CD",
  "slug": "team/devops/cicd-architecture-blueprint",
  "url": "/docs/team/devops/cicd-architecture-blueprint",
  "frontmatter": {
    "layout": "doc",
    "title": "بلوپرینت معماری CI/CD",
    "description": "معماری هدف CI/CD پلتفرم NONS — یکپارچه‌سازی مداوم، تحویل مداوم و استقرار خودکار",
    "version": "1.0.0",
    "status": "BLUEPRINT",
    "author": "Antigravity",
    "owner": "Devops Team",
    "created_at": "2026-06-15",
    "updated_at": "2026-06-15",
    "tags": "",
    "reviewers": ""
  },
  "sections": [
    {
      "level": 1,
      "heading": "بلوپرینت معماری CI/CD",
      "content": "**CI/CD Architecture Blueprint**\n\n---"
    },
    {
      "level": 2,
      "heading": "۱. نمای کلی معماری",
      "content": "```mermaid\nflowchart TB\n    subgraph Source[\"Source Control\"]\n        PR[\"Pull Request\"]\n        Main[\"main Branch\"]\n        Tag[\"Git Tag v*\"]\n    end\n\n    subgraph CI[\"CI Pipeline (GitHub Actions)\"]\n        Validate[\"Validate<br/>lint, typecheck, test\"]\n        Build[\"Build<br/>docker build\"]\n        Push[\"Push<br/>docker push\"]\n    end\n\n    subgraph CD[\"CD Pipeline\"]\n        DeployStaging[\"Deploy Staging<br/>helm upgrade\"]\n        E2E[\"E2E Tests\"]\n        DeployProd[\"Deploy Production<br/>(Manual Gate)\"]\n    end\n\n    subgraph Registry[\"Container Registry\"]\n        GHCR[\"ghcr.io/nons/*\"]\n    end\n\n    subgraph Cluster[\"Kubernetes Cluster\"]\n        Staging[\"Staging NS\"]\n        Production[\"Production NS\"]\n    end\n\n    PR --> Validate\n    Main --> Validate\n    Validate --> Build\n    Build --> Push\n    Push --> GHCR\n    GHCR --> DeployStaging\n    DeployStaging --> E2E\n    E2E -->|Approval| DeployProd\n    DeployProd --> Production\n    Tag --> Build\n```\n\n---"
    },
    {
      "level": 2,
      "heading": "۲. مؤلفه‌ها",
      "content": ""
    },
    {
      "level": 3,
      "heading": "۲.۱ Source Control Integration",
      "content": "| مؤلفه | ابزار |\n|-------|-------|\n| Version Control | GitHub |\n| CI Runner | GitHub Actions (ubuntu-latest) |\n| Artifact Storage | GitHub Container Registry (ghcr.io) |\n| Secret Management | GitHub Secrets + Environments |"
    },
    {
      "level": 3,
      "heading": "۲.۲ Build Automation",
      "content": "| مرحله | ابزار | ورودی | خروجی |\n|-------|------|-------|-------|\n| Lint | ESLint / golangci-lint | Source Code | Report |\n| Type Check | tsc --noEmit / go build | Source Code | — |\n| Unit Test | vitest / go test | Source + Test | Coverage |\n| Integration Test | vitest / go test + K3d | Source + Infra | Test Result |\n| Container Build | docker build | Source + Dockerfile | OCI Image |"
    },
    {
      "level": 3,
      "heading": "۲.۳ Image Publishing",
      "content": "```yaml"
    },
    {
      "level": 1,
      "heading": "CI Job: publish",
      "content": "steps:\n  - name: Build Image\n    run: |\n      IMAGE_TAG=sha-${{ github.sha::8 }}\n      docker build -t ghcr.io/nons/${{ env.SERVICE }}:$IMAGE_TAG .\n      docker push ghcr.io/nons/${{ env.SERVICE }}:$IMAGE_TAG\n\n  - name: Build Release Image\n    if: startsWith(github.ref, 'refs/tags/')\n    run: |\n      VERSION=${GITHUB_REF_NAME#*/v}\n      docker build -t ghcr.io/nons/${{ env.SERVICE }}:$VERSION .\n      docker tag ghcr.io/nons/${{ env.SERVICE }}:$VERSION ghcr.io/nons/${{ env.SERVICE }}:latest\n      docker push --all-tags ghcr.io/nons/${{ env.SERVICE }}\n```"
    },
    {
      "level": 3,
      "heading": "۲.۴ Deployment Automation",
      "content": "```yaml"
    },
    {
      "level": 1,
      "heading": "CD Job: deploy-staging",
      "content": "steps:\n  - name: Deploy to Staging\n    run: |\n      helm upgrade --install ${{ env.RELEASE }} ./deploy/helm/${{ env.SERVICE }} \\\n        --set image.tag=sha-${{ github.sha::8 }} \\\n        -n nons-platform \\\n        -f ./deploy/environments/staging/values.yaml\n```"
    },
    {
      "level": 3,
      "heading": "۲.۵ Release Governance",
      "content": "| مرحله | گیت | تأییدکننده |\n|-------|-----|-----------|\n| PR → main | Protected Branch + CI Green | Code Reviewer |\n| Staging Deploy | خودکار پس از merge | CI |\n| E2E Pass | خودکار پس از deploy | CI |\n| Production Deploy | تأیید دستی | Devops Team Lead |\n| Git Tag | دستی + GitHub Release | Devops Team |\n\n---"
    },
    {
      "level": 2,
      "heading": "۳. Pipeline Types",
      "content": ""
    },
    {
      "level": 3,
      "heading": "۳.۱ Pull Request Pipeline",
      "content": "```yaml\nname: PR Validation\non: pull_request\n\njobs:\n  validate:\n    runs-on: ubuntu-latest\n    steps:\n      - lint\n      - typecheck\n      - test:unit\n      - test:integration\n      - build:test  # docker build بدون push\n```"
    },
    {
      "level": 3,
      "heading": "۳.۲ Main Branch Pipeline",
      "content": "```yaml\nname: Main Build\non:\n  push:\n    branches: [main]\n\njobs:\n  validate:\n    runs-on: ubuntu-latest\n    steps:\n      - lint\n      - typecheck\n      - test:unit\n      - test:integration\n\n  publish:\n    needs: [validate]\n    steps:\n      - docker build\n      - docker push (sha tag)\n\n  deploy-staging:\n    needs: [publish]\n    steps:\n      - helm upgrade staging\n      - e2e tests\n```"
    },
    {
      "level": 3,
      "heading": "۳.۳ Release Pipeline",
      "content": "```yaml\nname: Release\non:\n  push:\n    tags: ['*/v*']\n\njobs:\n  publish-release:\n    runs-on: ubuntu-latest\n    steps:\n      - docker build\n      - docker push (version tag)\n      - docker push (latest)\n      - create github release\n\n  deploy-production:\n    needs: [publish-release]\n    environment: production\n    steps:\n      - helm upgrade production\n      - verification\n```\n\n---"
    },
    {
      "level": 2,
      "heading": "۴. Security Integration",
      "content": "| مرحله | ابزار | زمان |\n|-------|-------|------|\n| Secret Scanning | GitHub Secret Scanner | هر commit |\n| Dependency Audit | `npm audit` / `go mod verify` | هر PR |\n| Container Scan | Trivy / Docker Scout | هر push (فاز ۵) |\n| Signature | Cosign | هر Release (فاز ۵) |\n| SBOM | Syft | هر Release (فاز ۵) |\n\n---"
    },
    {
      "level": 2,
      "heading": "۵. GitHub Environments",
      "content": "| Environment |的保护规则 | Approvers |\n|------------|-----------|-----------|\n| `staging` | خودکار — بدون گیت | — |\n| `production` | Required reviewer + wait timer | Devops Team Lead |\n| `release` | Required tag | — |\n\n---"
    },
    {
      "level": 2,
      "heading": "۶. Failure Recovery",
      "content": "| مرحله | خطا | اقدام |\n|-------|-----|-------|\n| Validate | Lint/Test fail | PR blocked — developer fix |\n| Publish | Push fail | Retry job — اگر دوباره fail شد، issue |\n| Deploy | Helm fail | Rollback خودکار + notification |\n| E2E | Test fail | Rollback خودکار + block production gate |\n| Production | Health check fail | Rollback خودکار (helm rollback) |\n\n---"
    },
    {
      "level": 2,
      "heading": "۷. معماری هدف (Phased)",
      "content": "| فاز | قابلیت | وابستگی |\n|-----|--------|---------|\n| **Base** (Phase 0) | Lint + Build + Test (موجود) | — |\n| **CI** (Phase 1) | Image Build + Push + Staging Deploy | Container Registry Strategy |\n| **CD** (Phase 2) | Production Gate + Rollback | GitHub Environments |\n| **GitOps** (Phase 3) | ArgoCD / Flux + Declarative Config | فاز ۵ |\n| **Advanced** (Phase 4) | Image Signing + SBOM + Policy | فاز ۵ |\n\n---"
    },
    {
      "level": 2,
      "heading": "۸. خلاصه",
      "content": "| مؤلفه | تصمیم |\n|-------|--------|\n| CI Platform | GitHub Actions |\n| Build Tool | Docker CLI + BuildKit |\n| Registry | ghcr.io |\n| Deploy Tool | Helm CLI |\n| Environments | staging (auto) → production (manual gate) |\n| Rollback | `helm rollback` |\n| Security Scanning | فاز ۵ |\n| GitOps | فاز ۵ |"
    }
  ]
}