A homemade CI/CD pipeline with GitHub Actions

Short summary

Author describes a lightweight CI/CD pipeline using GitHub Actions, Docker, and SSH to deploy a Next.js app to a VPS. The pipeline chains lint → security scan (Trivy) → build → deploy, with each step blocking failures to prevent broken deploys. Key patterns include treating security scanning as mandatory, separating PR checks from production, and ignoring unfixed vulnerabilities to avoid blocked deployments.

• •CI/CD pipeline chains four steps with dependency gates: lint, security scan, image build, deploy
• •Trivy security scan blocks deployment on critical/high CVEs with available fixes; ignore-unfixed prevents blocking on upstream vulnerabilities
• •Separate PR workflow for type-checking and build validation; production deploys only on master via SSH + docker-compose

Generated with AI, which can make mistakes.