🔒 Safe Deployment Guide

⚠️ IMPORTANT: Read Before Pushing to GitHub

What Happens When You Push the Workflows?

Short answer: The workflows will try to run but FAIL SAFELY because GitHub secrets aren't configured yet.

Detailed behavior:

✅ Build & Test jobs will run successfully
❌ Deploy jobs will fail (missing secrets = no deployment possible)
✅ No production data will be affected
✅ No Azure resources will be deleted

🛡️ Production Safety Features

1. Manual Approval Required for Production

Production deployments now require manual approval via GitHub Environments:

Workflow runs automatically when you push to main
Waits at "production" environment checkpoint
You must approve in GitHub UI before deployment proceeds
Deployment only happens after your approval

To set this up:

bash

# In GitHub, go to:
Settings → Environments → New environment

# Create two environments:
- Name: "production"
  - Add "Required reviewers" (yourself or team)
  - Add "Wait timer" (optional: 5 minutes to review logs)
  
- Name: "development"  
  - No restrictions (auto-deploy)

2. Semantic Versioning

The workflows now:

Read version from package.json
Create Git tags for each deployment (e.g., backend-v1.2.3)
Allow easy rollback to previous versions

Update version before deploying:

bash

cd ctrl-audio-back
npm version patch  # 1.0.0 → 1.0.1 (bug fixes)
npm version minor  # 1.0.0 → 1.1.0 (new features)
npm version major  # 1.0.0 → 2.0.0 (breaking changes)

3. Separate Dev/Prod Environments

Environment	Branch	Auto-Deploy	Manual Approval
Development	`develop`	✅ Yes	❌ No
Production	`main`	❌ No	✅ Required

📝 Safe Deployment Steps

First Time Setup (Do This First!)

bash

# 1. Create a feature branch (DON'T push to main yet!)
git checkout -b setup/ci-cd

# 2. Commit the workflow files
git add .github/ infrastructure/ ctrl-audio-*/Dockerfile*
git commit -m "Add CI/CD infrastructure"

# 3. Push to feature branch
git push origin setup/ci-cd

# 4. Run Azure setup script locally
cd infrastructure
./setup-azure.sh

# 5. Configure GitHub Secrets (use output from setup script)
# Go to: GitHub → Settings → Secrets and variables → Actions

# 6. Configure GitHub Environments for production approval
# Go to: GitHub → Settings → Environments → New environment
#   - Create "production" environment
#   - Add yourself as required reviewer
#   - Create "development" environment (no restrictions)

# 7. Test with development branch first
git checkout -b develop
git merge setup/ci-cd
git push origin develop

# 8. Watch the workflow run (should deploy to -dev resources)
# Check: https://github.com/YOUR_REPO/actions

# 9. If successful, merge to main (will require your approval)
git checkout main
git merge develop
git push origin main

Regular Deployment Flow

bash

# Development (auto-deploy, no approval)
git checkout develop
# ... make changes ...
npm version patch  # Update version
git commit -am "Your changes"
git push origin develop
# → Automatically deploys to dev environment

# Production (manual approval required)
git checkout main
git merge develop
git push origin main
# → Waits for your approval
# → Go to GitHub Actions, review, and approve
# → Then deploys to production

🔄 Rollback Strategy

Option 1: Redeploy Previous Version (Recommended)

bash

# List available versions
git tag | grep backend-v

# Redeploy a specific version
az containerapp update \
  --name ctrl-audio-backend \
  --resource-group Sonnance-WebApp \
  --image sonnanceacr.azurecr.io/ctrl-audio-backend:COMMIT_SHA

# Or use Container Apps revision management
az containerapp revision list \
  --name ctrl-audio-backend \
  --resource-group Sonnance-WebApp

# Activate a previous revision
az containerapp revision activate \
  --revision ctrl-audio-backend--REVISION_NAME \
  --resource-group Sonnance-WebApp

Option 2: Emergency Stop

bash

# Stop the container app (zero replicas)
az containerapp update \
  --name ctrl-audio-backend \
  --resource-group Sonnance-WebApp \
  --min-replicas 0 \
  --max-replicas 0

❓ Your Questions Answered

Q: "Will it execute actions straight away?"

A: Yes, BUT:

✅ Builds/tests run immediately (safe, no deployment)
❌ Deployments FAIL without secrets (safe)
✅ Production deployments WAIT for your approval (safe)

How to prevent execution:

Push to a feature branch first (not main/develop)

Or temporarily disable workflows:

yaml

# Add at top of workflow file:
on:
  workflow_dispatch:  # Only manual triggers

Q: "Is it secure to delete and recreate files?"

A: The workflows NEVER delete files. They only:

Build Docker images
Deploy new versions to Azure
Azure keeps multiple revisions (rollback capability)

What Azure Container Apps does:

Keeps previous revisions (default: last 10)
Zero-downtime deployment (blue-green)
Automatic rollback on failure

Your data is safe because:

MongoDB Atlas is external (not touched)
Azure Blob Storage is external (not touched)
Only app code is redeployed

Q: "For production, we need to consider scaling/versions?"

A: Yes! Here's what's configured:

Scaling:

yaml

# Already configured in setup script:
Production:
  - min-replicas: 0 (scales to zero when idle = free!)
  - max-replicas: 3
  - Auto-scales based on HTTP traffic

Development:
  - min-replicas: 0
  - max-replicas: 2

To adjust scaling:

bash

az containerapp update \
  --name ctrl-audio-backend \
  --resource-group Sonnance-WebApp \
  --min-replicas 1 \
  --max-replicas 10 \
  --scale-rule-name http-scaling \
  --scale-rule-type http \
  --scale-rule-http-concurrency 50

Versioning:

✅ Semantic versioning from package.json
✅ Git tags created automatically
✅ Docker images tagged with commit SHA
✅ Container Apps keeps revision history

🚀 Production Readiness Checklist

Before deploying to production:

[ ] Run ./infrastructure/setup-azure.sh
[ ] Configure all GitHub secrets
[ ] Set up GitHub production environment with approvers
[ ] Test deployment to develop branch first
[ ] Update package.json version
[ ] Configure environment variables in Azure Container Apps
[ ] Set up monitoring/alerts in Azure
[ ] Document rollback procedure for your team
[ ] Configure custom domain (optional)
[ ] Enable Application Insights for monitoring (recommended)

📊 Monitoring & Health Checks

bash

# View real-time logs
az containerapp logs show \
  --name ctrl-audio-backend \
  --resource-group Sonnance-WebApp \
  --follow

# Check app health
az containerapp show \
  --name ctrl-audio-backend \
  --resource-group Sonnance-WebApp \
  --query "properties.runningStatus"

# View metrics
az monitor metrics list \
  --resource $(az containerapp show --name ctrl-audio-backend --resource-group Sonnance-WebApp --query id -o tsv) \
  --metric "Requests"

🆘 Emergency Contacts & Resources

Azure Support: Azure Portal
GitHub Actions Status: https://github.com/YOUR_ORG/YOUR_REPO/actions
Logs Location: Azure Portal → Container Apps → Your App → Logs
Rollback Guide: See "Rollback Strategy" above

🔒 Safe Deployment Guide ​

⚠️ IMPORTANT: Read Before Pushing to GitHub ​

What Happens When You Push the Workflows? ​

🛡️ Production Safety Features ​

1. Manual Approval Required for Production ​

2. Semantic Versioning ​

3. Separate Dev/Prod Environments ​

📝 Safe Deployment Steps ​

First Time Setup (Do This First!) ​

Regular Deployment Flow ​

🔄 Rollback Strategy ​

Option 1: Redeploy Previous Version (Recommended) ​

Option 2: Emergency Stop ​

❓ Your Questions Answered ​

Q: "Will it execute actions straight away?" ​

Q: "Is it secure to delete and recreate files?" ​

Q: "For production, we need to consider scaling/versions?" ​

🚀 Production Readiness Checklist ​

📊 Monitoring & Health Checks ​

🆘 Emergency Contacts & Resources ​

🔒 Safe Deployment Guide

⚠️ IMPORTANT: Read Before Pushing to GitHub

What Happens When You Push the Workflows?

🛡️ Production Safety Features

1. Manual Approval Required for Production

2. Semantic Versioning

3. Separate Dev/Prod Environments

📝 Safe Deployment Steps

First Time Setup (Do This First!)

Regular Deployment Flow

🔄 Rollback Strategy

Option 1: Redeploy Previous Version (Recommended)

Option 2: Emergency Stop

❓ Your Questions Answered

Q: "Will it execute actions straight away?"

Q: "Is it secure to delete and recreate files?"

Q: "For production, we need to consider scaling/versions?"

🚀 Production Readiness Checklist

📊 Monitoring & Health Checks

🆘 Emergency Contacts & Resources