feat: configure staging and production environments with GitHub Actions and AWS Lambda

[McCarthyCode]

Summary

Implements a comprehensive CI/CD pipeline and serverless infrastructure to replace manual EC2 deployments. This solution establishes clear separation between development, staging, and production environments with automated testing and deployment workflows.

Implementation Details

GitHub Actions CI/CD Pipeline

• Test Stage: Runs DevOps infrastructure tests and Docker validation on all commits
• Build Stage: Builds and pushes Docker images to GHCR on main branch
• Deploy Staging: Deploys to AWS Lambda staging environment and runs smoke tests
• Deploy Production: Deploys to AWS Lambda production after staging validation

Environment Configuration

• Separate .env files for development, staging, and production
• Clear separation of environment variables and secrets
• GitHub Secrets integration for sensitive configuration

AWS Lambda Infrastructure

• AWS SAM CloudFormation template for infrastructure-as-code
• Separate Lambda functions for staging and production
• HTTP API Gateway for request routing
• Environment-specific resource allocation and scaling
• CloudWatch monitoring and alarms

DevOps Test Suite

• Infrastructure validation tests (Docker, docker-compose, configurations)
• Smoke tests for staging and production health checks
• Pytest-based framework for extensibility
• Validates CSP headers, HTTPS enforcement, and endpoint responsiveness

Comprehensive Documentation

• DEPLOYMENT.md with complete deployment procedures
• Architecture overview and component descriptions
• Environment configuration reference
• Troubleshooting and rollback procedures

Requirements Addressed

✅ Building release images outside production (CI pipeline, not EC2)
✅ Decoupling from EC2 to serverless architecture (AWS Lambda)
✅ DevOps test suite for infrastructure validation
✅ GitHub Actions pipeline with staging and production stages
✅ Environment variable definitions for each stage
✅ SDLC best practices throughout

Required Setup

Before merging, configure GitHub repository:

1. AWS IAM Roles (for OIDC)

AWS_ROLE_ARN_STAGING
AWS_ROLE_ARN_PRODUCTION

2. Secrets

STAGING_SECRET_KEY
PRODUCTION_SECRET_KEY

3. GitHub Environments

• Create "staging" environment with URL: https://stage.mattmccarthy.io
• Create "production" environment with URL: https://mattmccarthy.io

4. Initial Lambda Deployment

See DEPLOYMENT.md for detailed Lambda setup instructions.

Testing

# Install dev dependencies
pip install -r requirements-dev.txt

# Run DevOps tests
pytest tests/devops/ -v

# Run smoke tests (requires deployed environment)
pytest tests/devops/smoke_tests.py -v

Related Issue

Closes #7

Notes

• This is a breaking change from EC2 deployment approach
• Existing EC2 infrastructure can be decommissioned after validation
• Feature tests (scope of future issues) are separate from DevOps tests
• Lambda tier selection (512MB staging, 1024MB production) can be adjusted based on performance monitoring

[McCarthyCode]

/oc summarize

[opencode-agent]

APIError: Your credit balance is too low to access the Anthropic API. Please go to Plans & Billing to upgrade or purchase credits.

opencode session  |  github run

[opencode-agent]

Summary

This pull request implements a comprehensive CI/CD pipeline and serverless infrastructure to modernize the deployment process, moving away from manual EC2 deployments to AWS Lambda.

Key Components

GitHub Actions Pipeline (.github/workflows/ci-cd.yaml:1-162)

• 4-stage workflow: Test → Build → Deploy Staging → Deploy Production
• Runs DevOps tests and Docker validation on all commits
• Builds and pushes Docker images to GHCR on main branch only
• Deploys to staging/production with automatic smoke tests

Environment Configuration

• Three environment files: development (local), staging, and production
• Each with appropriate logging levels and resource settings
• Secrets managed through GitHub Secrets + AWS IAM roles

AWS Lambda Infrastructure (infrastructure/lambda-template.yaml:1-147)

• CloudFormation/SAM template defining serverless architecture
• Separate Lambda functions per environment with environment-specific resource allocation:
  • Staging: 512MB, 10 concurrent executions
  • Production: 1024MB, 100 concurrent executions
• HTTP API Gateway for routing, CloudWatch monitoring, and error alarms

DevOps Test Suite (tests/devops/test_infrastructure.py:1-196)

• Infrastructure validation tests for Docker, docker-compose, and configurations
• Smoke tests for health checks and security headers (CSP, HTTPS)
• Pytest-based framework with coverage tracking

Documentation (DEPLOYMENT.md:1-457)

• Complete deployment procedures and architecture overview
• Environment configuration reference with secret management
• Troubleshooting and rollback procedures
• Development workflow guidelines

Requirements Addressed

✅ Building release images outside production (CI pipeline)
✅ Decoupling from EC2 to serverless (AWS Lambda)
✅ DevOps test suite with infrastructure validation
✅ GitHub Actions with staging/production stages
✅ Environment-specific configuration files
✅ SDLC best practices (IaC, separation of concerns, staged deployments)

Setup Requirements

Before merging, the repository needs:

• AWS IAM roles for OIDC: AWS_ROLE_ARN_STAGING, AWS_ROLE_ARN_PRODUCTION
• Secrets: STAGING_SECRET_KEY, PRODUCTION_SECRET_KEY
• GitHub Environments: "staging" and "production" with appropriate URLs
• Initial Lambda deployment via AWS SAM CLI (documented in DEPLOYMENT.md)

opencode session  |  github run