CI/CD & Infrastructure as Code

Philosophy: Code Over Configuration

Everything that can be expressed as code lives in the repository. Only secrets and environment-specific URLs go in the deployment dashboard. This principle is captured in the project rule: always prefer code over manual configuration.

CI Pipeline

GitHub Actions runs on every push and pull request:

Backend CI:

• Java 21 setup
• Maven verify (compile + test + integration tests with TestContainers)
• Build validation

Frontend CI:

• Node.js setup
• npm run build (TypeScript compilation + Vite build)
• npm test (Vitest unit tests)

Both pipelines must pass before merging. No green CI, no merge.

Deployment

Vivolar deploys to Railway with a two-environment strategy:

Staging (stg branch):

• Auto-deploys when the stg branch is updated
• Used for final validation before production
• Mirrors production configuration

Production (main branch):

• Deploys on merge to main
• Tagged with semantic versions (e.g., v2.7.0)
• Protected by the pre-deployment validation checklist

Infrastructure as Code

Configuration lives in the repository:

backend/railway.toml    — healthcheck, build settings
backend/nixpacks.toml   — JDK version, build command
frontend/railway.toml   — healthcheck, static serving
frontend/nixpacks.toml  — Node version, build command

These files are the source of truth. If Railway needs a configuration change, the .toml file is updated, committed, and deployed — not clicked in a dashboard.

Pre-Deployment Validation

Before any deployment, a 10-point checklist runs automatically:

1. Tests green
2. CORS configuration matches frontend URL
3. OAuth2 redirect URIs are correct
4. Frontend API URL matches backend domain
5. No hardcoded localhost references
6. Node version consistency
7. Java version consistency
8. Required environment variables present
9. Forward headers strategy configured
10. Health check endpoints configured

Blockers must be fixed. Warnings are reviewed. This script (scripts/pre-deploy-validate.sh) prevents the most common deployment failures.

Lessons

• IaC prevents drift. When configuration lives in code, you can diff it, review it, and roll it back. Dashboard settings are invisible to the team.
• Pre-deployment checklists catch real bugs. The CORS/URL mismatch check alone has prevented multiple broken deployments.
• Two environments are enough. Staging for validation, production for users. More environments add complexity without proportional benefit for a small project.