CI/CD Pipeline Plan From Your Existing Stack

2. When each runs:

• Push to feature branch: install + lint + typecheck + unit tests + build. No e2e.
• PR opened/updated to main: everything above + e2e (only when changes touch UI files or /app).
• Merge to main: full pipeline + auto-deploy to staging + smoke tests.
• Manual 'deploy-prod' label on PR: promote staging → prod.

3. .github/workflows/ci.yml:

name: CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

env:
  PNPM_VERSION: '9'
  NODE_VERSION: '20'

jobs:
  install:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v3
        with: { version: ${{ env.PNPM_VERSION }} }
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: pnpm
      - run: pnpm install --frozen-lockfile
      - uses: actions/cache@v4
        with:
          path: node_modules
          key: nm-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}

  lint-typecheck:
    needs: install
    runs-on: ubuntu-latest
    strategy:
      matrix:
        task: [lint, typecheck]
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v3
        with: { version: ${{ env.PNPM_VERSION }} }
      - uses: actions/setup-node@v4
        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
      - uses: actions/cache@v4
        with:
          path: node_modules
          key: nm-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
      - run: pnpm install --offline --frozen-lockfile
      - run: pnpm ${{ matrix.task }}

  unit-test:
    needs: install
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v3
        with: { version: ${{ env.PNPM_VERSION }} }
      - uses: actions/setup-node@v4
        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
      - uses: actions/cache@v4
        with:
          path: node_modules
          key: nm-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
      - run: pnpm install --offline --frozen-lockfile
      - run: pnpm test:unit -- --coverage
      - uses: actions/upload-artifact@v4
        with: { name: coverage, path: coverage }

  build:
    needs: [lint-typecheck, unit-test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v3
        with: { version: ${{ env.PNPM_VERSION }} }
      - uses: actions/setup-node@v4
        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
      - uses: actions/cache@v4
        with:
          path: node_modules
          key: nm-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
      - uses: actions/cache@v4
        with:
          path: .next/cache
          key: nextcache-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
      - run: pnpm install --offline --frozen-lockfile
      - run: pnpm build
        env:
          NEXT_PUBLIC_SUPABASE_URL: ${{ secrets.NEXT_PUBLIC_SUPABASE_URL }}
          NEXT_PUBLIC_SUPABASE_ANON_KEY: ${{ secrets.NEXT_PUBLIC_SUPABASE_ANON_KEY }}

  e2e:
    needs: build
    if: |
      github.event_name == 'pull_request' &&
      (contains(github.event.pull_request.labels.*.name, 'run-e2e') ||
       contains(toJson(github.event.pull_request.changed_files), 'app/') ||
       contains(toJson(github.event.pull_request.changed_files), 'components/'))
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_PASSWORD: postgres
          POSTGRES_DB: test
        ports: ['5432:5432']
    steps:
      - uses: actions/checkout@v4
      - uses: pnpm/action-setup@v3
        with: { version: ${{ env.PNPM_VERSION }} }
      - uses: actions/setup-node@v4
        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
      - run: pnpm install --frozen-lockfile
      - run: pnpm playwright install --with-deps chromium
      - run: pnpm db:migrate:test
      - run: pnpm test:e2e
        env:
          DATABASE_URL: postgresql://postgres:postgres@localhost:5432/test
      - if: failure()
        uses: actions/upload-artifact@v4
        with: { name: playwright-trace, path: test-results }

4. Deploy strategy:

• Vercel handles atomic deploys — each commit gets its own immutable URL. 'Promotion' is just pointing the prod alias at a previous build.
• Use Vercel's preview deploys for every PR (built-in).
• For prod: use 'Deploy Hooks' triggered by a 'deploy-prod' label on a merged PR.

5. Rollback:

• One command: vercel alias mycopyprompt.in <previous_deployment_url>.
• Or in Vercel dashboard: Deployments → previous → 'Promote to Production'.
• Under 60 seconds, no rebuild needed.
• Have the previous-deployment-URL pinned in a Slack channel after every prod deploy.

6. Cost-saving moves:

1. E2E gating — your biggest win. The if condition above only runs Playwright when UI changed OR a label is added. Saves 12 min × ~80% of commits.
2. .next/cache caching — Next.js incremental builds are 3-5x faster with this cache. Often skipped.
3. pnpm install --offline in downstream jobs — skip network entirely after the first install job. Saves 30-60 seconds per job.

7. What to monitor:

• Median pipeline runtime — should stay under 6 minutes for the no-e2e path.
• Pipeline failure rate by job — flaky e2e shows up as e2e-only failures.
• Time-to-deploy (merge to prod URL) — anything > 15 min on prod deploy means investigate.
• Cache hit rate — if your install cache is < 80% hit, you're paying for installs you didn't need.