🗣️ एक pipeline, चार बोली

📄 .circleci/config.yml

# 🔄 The SAME pipeline in the CircleCI dialect (lesson 11).
#   test (matrix) → build-and-push (context = the badge) → hold-for-approval → deploy-to-eks
# Modeled on a real pipeline: only the jobs that talk to AWS receive the context (least privilege).
# The context `school-cicd` must provide AWS_ROLE_ARN (OIDC) or AWS keys, AWS_ACCOUNT_ID,
# AWS_DEFAULT_REGION, ECR_REPOSITORY, EKS_CLUSTER.
version: 2.1

orbs:
  aws-cli: circleci/aws-cli@5.1        # `aws-cli/setup` with role_arn = OIDC, no stored keys

parameters:
  node-versions:
    type: string
    default: "20.18,22.12,24.0"

jobs:
  test:
    parameters:
      node:
        type: string
    docker:
      - image: cimg/node:<< parameters.node >>
    working_directory: ~/repo/app
    steps:
      - checkout:
          path: ~/repo
      - restore_cache:                                        # lesson 04: the drawer
          keys:
            - prepared-v1-{{ checksum "prepare.js" }}
      - run:
          name: ⏳ prepare (skipped when restored from cache)
          command: node prepare.js
      - save_cache:
          key: prepared-v1-{{ checksum "prepare.js" }}
          paths: [prepared]
      - run:
          name: 🧪 test
          command: |
            mkdir -p test-results
            node --test --test-reporter=spec --test-reporter-destination=stdout \
                        --test-reporter=junit --test-reporter-destination=test-results/junit.xml
      - store_test_results:                                   # lesson 05: the report card, parsed
          path: test-results
      - store_artifacts:                                      # …and the raw file, downloadable
          path: test-results

  build-and-push:
    docker:
      - image: cimg/aws:2024.03          # AWS CLI + Docker CLI preinstalled
    steps:
      - checkout
      - setup_remote_docker              # a Docker engine for this job to build with
      - aws-cli/setup:                   # 🪪 OIDC badge → temporary credentials
          role_arn: ${AWS_ROLE_ARN}
          region: ${AWS_DEFAULT_REGION}
      - run:
          name: 🍱 build, smoke-test, tag with the commit SHA, push
          command: |
            REGISTRY="${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com"
            IMAGE="${REGISTRY}/${ECR_REPOSITORY}:${CIRCLE_SHA1}"
            docker build --build-arg APP_VERSION=${CIRCLE_SHA1:0:7} -t "$IMAGE" app
            docker run -d --rm -p 3000:3000 --name smoke "$IMAGE"
            sleep 2 && docker exec smoke wget -qO- localhost:3000/healthz && docker stop smoke
            aws ecr get-login-password --region "$AWS_DEFAULT_REGION" \
              | docker login --username AWS --password-stdin "$REGISTRY"
            docker push "$IMAGE"

  deploy-to-eks:
    parameters:
      namespace:
        type: string
    docker:
      - image: cimg/aws:2024.03
    steps:
      - checkout
      - aws-cli/setup:
          role_arn: ${AWS_ROLE_ARN}
          region: ${AWS_DEFAULT_REGION}
      - run:
          name: 🔧 kubectl → cluster
          command: |
            curl -sLO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
            sudo install kubectl /usr/local/bin/kubectl
            aws eks update-kubeconfig --region "$AWS_DEFAULT_REGION" --name "$EKS_CLUSTER"
      - run:
          name: 📌 apply and wait for the rollout
          command: |
            IMAGE="${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_DEFAULT_REGION}.amazonaws.com/${ECR_REPOSITORY}:${CIRCLE_SHA1}"
            sed -i "s|IMAGE_PLACEHOLDER|${IMAGE}|" k8s/deployment.yaml
            kubectl apply -n << parameters.namespace >> -f k8s/
            kubectl rollout status -n << parameters.namespace >> deployment/hello-courier --timeout=180s

workflows:
  test-build-deploy:
    jobs:
      - test:                            # NO context: tests never see cloud credentials
          matrix:
            parameters:
              node: ["20.18", "22.12", "24.0"]
      - build-and-push:
          context: school-cicd
          requires: [test]
          filters:
            branches:
              only: main                 # only main gets built and pushed
      - deploy-to-eks:
          name: deploy-staging
          namespace: staging
          context: school-cicd
          requires: [build-and-push]
      - hold-for-approval:               # 🛑 the principal's signature: click Approve in the UI
          type: approval
          requires: [deploy-staging]
      - deploy-to-eks:
          name: deploy-production
          namespace: production
          context: school-cicd
          requires: [hold-for-approval]

📄 .gitlab-ci.yml

# 🦊 The SAME pipeline in the GitLab CI dialect (lesson 11).
#   stages: test → build → deploy   (jobs in one stage run in parallel)
# Set these CI/CD variables on the project: AWS_ROLE_ARN, AWS_REGION, AWS_ACCOUNT_ID,
# ECR_REPOSITORY, EKS_CLUSTER. Credentials come from an ID token (OIDC) — no stored keys.
stages: [test, build, deploy]

variables:
  AWS_REGION: ap-south-1

test:
  stage: test
  image: node:${NODE}-alpine
  parallel:
    matrix:                                   # lesson 04: three rulers
      - NODE: ["20", "22", "24"]
  cache:                                      # lesson 04: the drawer, keyed by the file that defines the work
    key:
      files: [app/prepare.js]
    paths: [app/prepared/]
  script:
    - cd app
    - node prepare.js                         # prints "already exists" on a cache hit
    - node --test --test-reporter=spec --test-reporter-destination=stdout
                  --test-reporter=junit --test-reporter-destination=test-results.xml
  artifacts:                                  # lesson 05: the report card — parsed into the MR widget
    when: always
    reports:
      junit: app/test-results.xml
    paths: [app/test-results.xml]
    expire_in: 1 week

.aws-badge: &aws-badge                        # 🪪 OIDC: exchange GitLab's ID token for temporary AWS credentials
  id_tokens:
    GITLAB_OIDC_TOKEN:
      aud: https://gitlab.com
  before_script:
    - >
      export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s"
      $(aws sts assume-role-with-web-identity
      --role-arn "$AWS_ROLE_ARN" --role-session-name "gitlab-${CI_PIPELINE_ID}"
      --web-identity-token "$GITLAB_OIDC_TOKEN" --duration-seconds 3600
      --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]' --output text))

build-and-push:
  stage: build
  image: docker:27
  services: [docker:27-dind]
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH   # only the default branch gets built and pushed
  <<: *aws-badge
  script:
    - apk add --no-cache aws-cli curl
    - REGISTRY="${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com"
    - IMAGE="${REGISTRY}/${ECR_REPOSITORY}:${CI_COMMIT_SHA}"
    - docker build --build-arg APP_VERSION=${CI_COMMIT_SHORT_SHA} -t "$IMAGE" app
    - docker run -d --rm -p 3000:3000 --name smoke "$IMAGE" && sleep 2 && docker exec smoke wget -qO- localhost:3000/healthz && docker stop smoke
    - aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REGISTRY"
    - docker push "$IMAGE"

.deploy: &deploy
  stage: deploy
  image: amazon/aws-cli:2.17.0
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
  <<: *aws-badge
  script:
    - curl -sLO "https://dl.k8s.io/release/$(curl -sL https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" && install kubectl /usr/local/bin/kubectl
    - aws eks update-kubeconfig --region "$AWS_REGION" --name "$EKS_CLUSTER"
    - IMAGE="${AWS_ACCOUNT_ID}.dkr.ecr.${AWS_REGION}.amazonaws.com/${ECR_REPOSITORY}:${CI_COMMIT_SHA}"
    - sed -i "s|IMAGE_PLACEHOLDER|${IMAGE}|" k8s/deployment.yaml
    - kubectl apply -n "$NAMESPACE" -f k8s/
    - kubectl rollout status -n "$NAMESPACE" deployment/hello-courier --timeout=180s

deploy-staging:
  <<: *deploy
  variables: { NAMESPACE: staging }
  environment: { name: staging }

deploy-production:
  <<: *deploy
  needs: [deploy-staging]
  variables: { NAMESPACE: production }
  environment: { name: production }
  when: manual                                # 🛑 the principal's signature: a human presses ▶ in the UI

📄 Jenkinsfile

// 🎩 The SAME pipeline in the Jenkins (declarative) dialect — lesson 11.
//   ✅ test (matrix) → 📦 build & push → 🛑 approve → 🚚 deploy
// Needs on the controller: Docker Pipeline, JUnit and Pipeline: AWS Steps plugins, plus a
// credential `aws-school-cicd` (IAM keys or, better, a role assumed by the agent).
pipeline {
  agent none
  options { timestamps(); disableConcurrentBuilds() }
  environment {
    AWS_REGION     = 'ap-south-1'
    ECR_REPOSITORY = 'hello-courier'
    EKS_CLUSTER    = 'school-eks'
  }
  stages {
    stage('✅ test') {
      matrix {                                         // lesson 04: three rulers, in parallel
        axes { axis { name 'NODE'; values '20', '22', '24' } }
        agent { docker { image "node:${NODE}-alpine" } }
        stages {
          stage('test') {
            steps {
              dir('app') {
                // Jenkins has no built-in cache step: a persistent agent keeps the workspace
                // (so prepared/ survives between builds); ephemeral agents need the Job Cacher plugin.
                sh 'node prepare.js'
                sh '''node --test --test-reporter=spec  --test-reporter-destination=stdout \
                                  --test-reporter=junit --test-reporter-destination=test-results.xml'''
              }
            }
            post { always { junit 'app/test-results.xml' } }   // lesson 05: the report card
          }
        }
      }
    }
    stage('📦 build & push') {
      when { branch 'main' }
      agent any
      steps {
        withAWS(credentials: 'aws-school-cicd', region: env.AWS_REGION) {
          sh '''
            ACCOUNT=$(aws sts get-caller-identity --query Account --output text)
            REGISTRY="${ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com"
            IMAGE="${REGISTRY}/${ECR_REPOSITORY}:${GIT_COMMIT}"
            docker build --build-arg APP_VERSION=$(echo "$GIT_COMMIT" | cut -c1-7) -t "$IMAGE" app   # POSIX sh: no ${VAR:0:7}
            docker run -d --rm -p 3000:3000 --name smoke "$IMAGE" && sleep 2 \
              && docker exec smoke wget -qO- localhost:3000/healthz && docker stop smoke
            aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REGISTRY"
            docker push "$IMAGE"
          '''
        }
      }
    }
    stage('🚚 staging') {
      when { branch 'main' }
      agent any
      steps { script { deployTo('staging') } }
    }
    stage('🛑 approve') {
      when { branch 'main' }
      options { timeout(time: 2, unit: 'DAYS') }
      steps { input message: 'Deploy to production?', ok: 'Approve' }   // the principal's signature
    }
    stage('🚚 production') {
      when { branch 'main' }
      agent any
      steps { script { deployTo('production') } }
    }
  }
}

def deployTo(String namespace) {
  withAWS(credentials: 'aws-school-cicd', region: env.AWS_REGION) {
    sh """
      ACCOUNT=\$(aws sts get-caller-identity --query Account --output text)
      IMAGE="\${ACCOUNT}.dkr.ecr.${env.AWS_REGION}.amazonaws.com/${env.ECR_REPOSITORY}:${env.GIT_COMMIT}"
      aws eks update-kubeconfig --region ${env.AWS_REGION} --name ${env.EKS_CLUSTER}
      sed -i "s|IMAGE_PLACEHOLDER|\${IMAGE}|" k8s/deployment.yaml
      kubectl apply -n ${namespace} -f k8s/
      kubectl rollout status -n ${namespace} deployment/hello-courier --timeout=180s
    """
  }
}