10.5-bob: CI/CD — GitHub Actions

  UCH ATAMA (ko'pincha aralashtiriladi):

  CI — Continuous Integration (uzluksiz integratsiya):
   har push/PR'da kod AVTOMATIK birlashtirilib tekshiriladi
   lint + test + build (xato darrov topiladi, kichik bo'lakda)
   maqsad: "main" doim ishlaydigan holatda (broken bo'lmasin)

  CD (1) — Continuous Delivery (uzluksiz YETKAZIB BERISH):
   CI o'tgach, kod CHIQARISHGA TAYYOR holatga keladi (artifact/image)
   production'ga chiqarish — QO'LDA tugma/tasdiq bilan (odam bosadi)

  CD (2) — Continuous Deployment (uzluksiz JOYLASHTIRISH):
   CI o'tgach, AVTOMATIK production'ga chiqadi (qo'lda tasdiq YO'Q)
   eng yuqori avtomatlashtirish (kuchli test ishonchi kerak)

  ┌──────┐   ┌──────┐   ┌───────┐   ┌──────────┐   ┌─────────┐
  │ push │  │ lint │  │ test  │  │  build   │  │ deploy  │
  └──────┘   └──────┘   └───────┘   └──────────┘   └─────────┘
             └──────── CI ─────────┘ └──── CD ─────┘

  GITHUB ACTIONS — GitHub ichidagi CI/CD (alohida server kerak emas):

  EVENT (hodisa)           push, pull_request, schedule, manual
     │  ishga tushiradi
     ▼
  WORKFLOW (.github/workflows/ci.yml)    butun jarayon (YAML fayl)
     ├── JOB: test         bir RUNNER'da ishlaydi (alohida mashina)
     │    ├── STEP 1: checkout (kodni ol)
     │    ├── STEP 2: setup-node (Node o'rnat)
     │    ├── STEP 3: npm ci (paket o'rnat)
     │    └── STEP 4: npm test (test)
     └── JOB: deploy       boshqa RUNNER (needs: test — test o'tgach)
          └── STEP: serverga chiqar

  TUSHUNCHALAR:
  - WORKFLOW: butun avtomatik jarayon (bir .yml fayl)
  - JOB: mustaqil ishlar to'plami (bir runner'da, default — parallel)
  - STEP: bitta qadam (buyruq yoki action)
  - RUNNER: ishni bajaradigan virtual mashina (GitHub beradi)
  - ACTION: qayta ishlatiladigan tayyor blok (uses bilan ulanadi)

  WORKFLOW FAYLI — .github/workflows/ ichida (.yml/.yaml):

  name: CI                           workflow nomi (UI'da ko'rinadi — ixtiyoriy)

  on:                                QACHON ishga tushadi (trigger — 2.5)
    push:
      branches: [main]               faqat main'ga push'da

  jobs:                              ishlar (kamida bitta)
    test:                            job ID (ixtiyoriy nom)
      runs-on: ubuntu-latest         qaysi runner 2.4-bob
      steps:                         qadamlar (ketma-ket)
        - uses: actions/checkout@v4  action ishlatish (uses — 2.7)
        - name: Testlarni ishga tushir    qadam nomi (ixtiyoriy)
          run: |                     shell buyruq (run)
            npm ci
            npm test

   YAML — bo'sh joy (indent) MUHIM (tab YO'Q — faqat probel, 2 ta)
   "-"  ro'yxat elementi (step) ;  "key:"  kalit-qiymat

  RUNNER — workflow'ni bajaradigan mashina (job shu yerda ishlaydi):

  GITHUB-HOSTED (GitHub beradi — eng oson):
  runs-on: ubuntu-latest       Linux (eng keng, tez, arzon)
  runs-on: windows-latest      Windows
  runs-on: macos-latest        macOS (qimmatroq — iOS build uchun)
   Har job uchun TOZA, yangi mashina (izolyatsiya)
   Sozlash kerak emas (Node, Docker, git oldindan bor)
   Public repo — BEPUL; private — oylik daqiqa limiti

  SELF-HOSTED (o'zingning mashinang):
  runs-on: self-hosted         o'z serveringda runner agent ishlaydi
   Kuchli/maxsus apparat (GPU, ko'p RAM)
   Ichki tarmoqqa kirish (private resurs)
   O'zing boqasan (yangilash, xavfsizlik — public repo'da XAVFLI)

   Boshlash uchun: ubuntu-latest (99% holatda yetarli)

  ON — workflow QACHON ishga tushadi (trigger event):

  on:
    push:                         push bo'lganda
      branches: [main, dev]       faqat shu branch'larga
      paths: ["src/**"]           faqat shu fayllar o'zgarsa (ixtiyoriy)
      tags: ["v*"]                teg push'da (release)

    pull_request:                 PR ochilganda/yangilanganda 4.3-bob
      branches: [main]            main'ga qaratilgan PR

    schedule:                     vaqt jadvali (cron)
      - cron: "0 3 * * *"         har kuni 03:00 UTC (kechasi test)

    workflow_dispatch:            QO'LDA tugma (UI'dan ishga tushirish)
      inputs:                     (ixtiyoriy) kiruvchi qiymatlar
        environment:
          type: choice
          options: [staging, production]

   pull_request — fork'dan kelgan PR'da SECRET berilmaydi (xavfsizlik)
   cron — UTC vaqtida (mahalliy vaqt EMAS)

  JOB'LAR — default PARALLEL (bir vaqtda), needs bilan SEQUENTIAL:

  jobs:
    lint:                    ┐
      runs-on: ubuntu-latest │ lint va test PARALLEL
    test:                    │ (bir vaqtda — tez)
      runs-on: ubuntu-latest ┘

    deploy:
      needs: [lint, test]     lint VA test o'tgach (sequential)
      runs-on: ubuntu-latest │ ikkalasi muvaffaqiyatli bo'lsa

  ┌──────┐
  │ lint │──┐
  └──────┘  │   ┌────────┐
            ├──▶│ deploy │    needs: ikkalasini KUTADI
  ┌──────┐  │   └────────┘
  │ test │──┘
  └──────┘

   Har job TOZA mashina (deploy lint'ning fayllarini KO'RMAYDI)
   fayl kerak bo'lsa: artifact (upload/download — 2.9)
   needs'dagi job FAIL bo'lsa  keyingi job ISHLAMAYDI (to'xtaydi)

  ACTION — qayta ishlatiladigan tayyor blok (boshqalar yozgan):

  steps:
    - uses: actions/checkout@v4          rasmiy action (kodni oladi)
                  │        │   │
                  │        │   └─ VERSIYA (@v4 — har doim qadab qo'y!)
                  │        └─ action nomi
                  └─ ega (org/user yoki "actions" — GitHub rasmiy)

    - uses: actions/setup-node@v4        Node o'rnatadi
      with:                              action'ga PARAMETR berish
        node-version: "20"
        cache: "npm"

  ENG KENG ISHLATILADIGAN ACTION'LAR (2026):
  actions/checkout@v4           repo kodini runner'ga oladi (ENG BIRINCHI)
  actions/setup-node@v4         Node.js + npm cache
  actions/cache@v4              ixtiyoriy fayllarni keshlash 2.8-bob
  actions/upload-artifact@v4    build natijasini saqlash 2.9-bob
  docker/build-push-action@v6   Docker image qurish+push 10.3-bob
  appleboy/ssh-action@v1        SSH orqali serverda buyruq (10.1)

   Versiyani QADA (@v4) — @main XAVFLI (har o'zgarishda buzilishi mumkin)

  SECRET — maxfiy qiymat (parol, kalit, token) — kodga YOZILMAYDI:

  REPO SECRETS (Settings  Secrets and variables  Actions):
   SSH_PRIVATE_KEY, DB_PASSWORD, API_TOKEN... (UI'da kiritiladi)
   workflow'da: ${{ secrets.SSH_PRIVATE_KEY }}
   log'da AVTOMATIK yashiriladi (*** ko'rinadi — chiqsa ham)

  GITHUB_TOKEN — har run'da AVTOMATIK beriladi (alohida yaratmaysan):
   repo'ga cheklangan huquq (push, GHCR'ga image — 10.4)
   ${{ secrets.GITHUB_TOKEN }}
   permissions bilan huquqni cheklash (eng kam imtiyoz — 10.1: 2.4):
  permissions:
    contents: read
    packages: write           GHCR'ga push uchun

  OIDC (OpenID Connect) — SECRET'SIZ bulutga kirish (eng zamonaviy):
   uzoq muddatli AWS kalit saqlamaysan (xavf yo'q)
   GitHub qisqa muddatli token beradi, AWS ishonadi 10.6-bob
  permissions:
    id-token: write           OIDC token so'rash uchun

   Secret'ni HECH QACHON echo qilma / log'ga chiqarma / kodga yozma

  CACHE — qayta yuklanadigan fayllarni saqlash (TEZLIK):
  Muammo: har run npm install ~2 daqiqa (node_modules qayta yuklanadi)
  Yechim: bir marta yukla, KESHLA, keyingi run tayyor oladi

  - uses: actions/setup-node@v4
    with:
      node-version: "20"
      cache: "npm"             npm keshini AVTOMATIK boshqaradi (eng oson)
   package-lock.json o'zgarmasa — keshdan oladi (sekundlar)

  ARTIFACT — job natijasini SAQLASH (job'lar/yuklab olish uchun):
  Muammo: test job dist/ qurdi, deploy job uni KO'RMAYDI 2.6-bob
  Yechim: build job artifact YUKLAYDI, deploy YUKLAB OLADI

  - uses: actions/upload-artifact@v4      build job'da
    with: { name: dist, path: dist/ }
  - uses: actions/download-artifact@v4    deploy job'da
    with: { name: dist }

   CACHE — tezlik (qayta yuklamaslik) ; ARTIFACT — natija uzatish/saqlash

  ENVIRONMENT — deploy maqsadini ifodalaydi (staging, production):

  jobs:
    deploy:
      environment: production    bu job production muhitiga deploy qiladi
      runs-on: ubuntu-latest

  HIMOYA QOIDALARI (Settings  Environments  production):
   Required reviewers — deploy oldidan ODAM TASDIQI (manual gate)
     production'ga chiqishdan oldin senior "Approve" bosadi (CD Delivery)
   Wait timer — N daqiqa kutish (shoshilinch qaytarish imkoni)
   Deployment branches — faqat main'dan deploy (boshqa branch'dan yo'q)
   Environment secrets — shu muhitga xos secret (prod DB paroli)

  ┌──────┐   ┌──────┐   ┌─────────────┐   ┌────────────┐
  │ test │──▶│build │──▶│ APPROVAL?  │──▶│ deploy prod│
  └──────┘   └──────┘   └─────────────┘   └────────────┘
                         (odam Approve bosguncha kutadi)

   production deploy'ga ALBATTA approval qo'y (xato deploy qaytarib bo'lmaydi)

  TIPIK PIPELINE BOSQICHLARI (ketma-ket, har biri o'tishi shart):

  1. CHECKOUT      kodni ol (actions/checkout)
  2. SETUP         Node/Docker o'rnat (setup-node)
  3. INSTALL       npm ci (lockfile'dan aniq versiya — 5.2)
  4. LINT          npm run lint (ESLint — kod sifati — 15.3)
  5. TEST          npm test (Jest — unit/e2e — 8.11)
  6. BUILD         npm run build (dist/ — TS compile)
  7. DOCKER        image qurish + registry'ga push (10.3, 10.4)
  8. DEPLOY        serverga chiqarish (quyidagi 3 usuldan biri)

  DEPLOY STRATEGIYALARI:
  A) SSH + buyruq   appleboy/ssh-action: serverda "git pull && restart"
  B) Docker pull    server "docker compose pull && up -d" 10.4-bob
  C) rsync          fayllarni serverga sinxron (10.1: 2.11)

   TARTIB MUHIM: avval lint/test (arzon, tez)  keyin build/deploy
   test FAIL bo'lsa, deploy'gacha YETMAYDI (buzuq kod chiqmaydi)

  REUSABLE WORKFLOW — bir workflow'ni boshqasidan chaqirish (DRY):
  Muammo: 5 ta repo'da bir xil CI yozish (takror — 15.1)
  Yechim: bir umumiy workflow, hammasi chaqiradi (workflow_call)

  # .github/workflows/reusable-ci.yml (umumiy)
  on:
    workflow_call:               boshqa workflow chaqira oladi

  # ishlatuvchi workflow:
  jobs:
    ci:
      uses: ./.github/workflows/reusable-ci.yml
      secrets: inherit           secret'larni uzatish

  BRANCH PROTECTION (Settings  Branches) — CI'ni MAJBURIY qilish:
   Require status checks — CI o'tmasa, PR merge BO'LMAYDI 4.3-bob
   Require PR review — kamida 1 odam ko'rib chiqsin (code review — 15.2)
   Require up to date — eng yangi main bilan (konflikt oldini olish)

   Branch protection'siz CI — "tavsiya" (hech kim majbur emas)
   Branch protection bilan — qizil CI = merge YO'Q (sifat kafolati)

  CONCURRENCY — bir vaqtda faqat bitta run (eskisini bekor qiladi):
  Muammo: bitta PR'ga 5 ta commit ketma-ket  5 ta CI run (4 tasi keraksiz)

  concurrency:
    group: ci-${{ github.ref }}        guruh kaliti (branch/PR bo'yicha)
    cancel-in-progress: true           shu guruhda eski run'ni BEKOR qil

   yangi push kelsa, o'sha branch'ning eski (tugamagan) run'i to'xtaydi
   faqat oxirgi commit tekshiriladi (vaqt/pul tejaladi)

   DEPLOY job'da EHTIYOT: cancel-in-progress: false (yarim deploy XAVFLI)
   deploy uchun group qo'y, lekin bekor qilma (navbatga tur)

  OIDC (OpenID Connect) — SECRET'SIZ bulutga kirish (2026 standarti):

  ESKI USUL (xavfli):
   AWS access key + secret'ni repo secret'ga yozasiz
   uzoq muddatli kalit (leak bo'lsa — abadiy xavf, qo'lda rotate)

  OIDC USUL (xavfsiz):
  1. GitHub Actions run vaqtida QISQA MUDDATLI token so'raydi (id-token)
  2. AWS/GCP/Azure GitHub'ni "ishonchli identity provider" deb tan oladi
  3. AWS qisqa muddatli (1 soat) STS credential beradi (rol orqali)
  4. Kalit HECH QAYERDA saqlanmaydi (har run yangi, o'z-o'zidan tugaydi)

  permissions:
    id-token: write         OIDC token so'rash MAJBURIY
    contents: read

  - uses: aws-actions/configure-aws-credentials@v4
    with:
      role-to-assume: arn:aws:iam::123456789:role/gha-deploy
      aws-region: eu-central-1
  # secret YO'Q — parolsiz!

   AWS tomonda: IAM OIDC provider + trust policy (repo'ni cheklaydi)

  IKKI XIL "QAYTA ISHLATISH" — aralashtirmaslik kerak:

  COMPOSITE ACTION — bir nechta STEP'ni bitta action'ga o'raydi:
   action.yml faylida (repo/.github/actions/setup/action.yml)
   step darajasida ishlaydi (uses: ./.github/actions/setup)
   maqsad: takrorlanadigan STEP KETMA-KETLIGI (checkout+node+ci)

  # .github/actions/setup/action.yml
  runs:
    using: composite
    steps:
      - uses: actions/setup-node@v4
        with: { node-version: "20", cache: "npm" }
      - run: npm ci
        shell: bash             composite'da shell MAJBURIY

  REUSABLE WORKFLOW — butun JOB(lar)ni qayta ishlatadi 2.12-bob:
   on: workflow_call ; uses: ...reusable.yml (job darajasida)
   maqsad: butun PIPELINE'ni ulashish (bir nechta job, runner)

   Composite = step'lar bloki (bir job ichida) ; Reusable = job'lar (butun oqim)

  DEPLOY STRATEGIYALARI — yangi versiyani XAVFSIZ chiqarish:

  1) RECREATE (eng oddiy — downtime bor):
     eskisini o'chir  yangisini yoq (bir necha soniya ilova o'chadi)

  2) ROLLING (bosqichma-bosqich — downtime yo'q):
     N ta nusxadan bittasini yangila  sog'lom bo'lsa keyingisini...
      eski va yangi versiya BIR VAQTDA ishlaydi (mos bo'lishi kerak)

  3) BLUE-GREEN (ikki muhit — bir zumda almashtirish):
     BLUE (joriy, jonli) + GREEN (yangi, tayyorlanadi)
      GREEN test'dan o'tsa  trafik BLUE'dan GREEN'ga o'tkaziladi (LB)
      xato bo'lsa — bir zumda BLUE'ga qaytariladi (tez rollback)
      ikki barobar resurs kerak (ikki to'liq muhit)

  4) CANARY (asta-sekin — eng ehtiyotkor):
     yangi versiyaga trafikning 5%  kuzat  25%  50%  100%
      xato metrika (5xx, latency) ko'rinsa — to'xtat, qaytar
      xatoni foydalanuvchilarning KICHIK qismi ko'radi (zarar kam)

   GitHub Actions — DEPLOY'ni ISHGA TUSHIRADI ; strategiyani platforma
     bajaradi (Kubernetes, ECS, Nginx/LB, Argo Rollouts)

  ROLLBACK — production yiqilganda oldingi ishlaydigan versiyaga qaytish:

  MUHIM QOIDA: har deploy IZLANADIGAN versiya bilan (latest EMAS):
   image:latest  qaysi kod ekani noma'lum (rollback qiyin)
   image:${{ github.sha }}  aniq commit (rollback = oldingi SHA)

  ROLLBACK USULLARI:
  1) Docker teg orqali: serverda oldingi image tegini qayta yoq
     docker compose up -d  (image: ...:<oldingi-sha>)
  2) Git orqali: git revert <buzuq-commit>  push  CI qayta deploy
  3) Blue-green: LB'ni blue'ga qaytar (soniyalar — 2.16)
  4) workflow_dispatch: "rollback" workflow, input: qaysi versiyaga

   DB migratsiyasi — ROLLBACK QIYIN (oldga mos migratsiya yozing)
   deploy oldidan backup 10.8-bob, migratsiya orqaga qaytadigan bo'lsin

  AVTOMATIK XAVFSIZLIK — kod va bog'liqliklarni tekshirish:

  DEPENDABOT — eskirgan/xavfli paketlarni topadi va PR ochadi:
  # .github/dependabot.yml
  version: 2
  updates:
    - package-ecosystem: "npm"
      directory: "/"
      schedule: { interval: "weekly" }    har hafta yangilanish tekshiradi
   xavfli paket topilsa — avtomatik "bump" PR (siz merge qilasiz)

  CODEQL — kodni statik tahlil (SQL injection, XSS... topadi):
  # .github/workflows/codeql.yml
  - uses: github/codeql-action/init@v3
    with: { languages: javascript }
  - uses: github/codeql-action/analyze@v3
   topilgan zaifliklar "Security" tab'da (14-qism)

   Ikkalasi ham GitHub'da BEPUL (public repo) — ALBATTA yoqing

  MONOREPO — bir repo'da ko'p paket/servis (path filter MUHIM):
  on:
    push:
      paths: ["apps/api/**"]     faqat api o'zgarsa — api CI ishlaydi
   har servisga alohida workflow (yoki path filter)
   Turbo/Nx: faqat O'ZGARGAN paketni build/test (affected — tez)

  BADGE — README'da CI holati belgisi (yashil/qizil):
  ![CI](https://github.com/OWNER/REPO/actions/workflows/ci.yml/badge.svg)
   repo ochilganda darrov ko'rinadi: build o'tyaptimi

  BOSHQA CI PLATFORMALAR (konsept bir xil):
  GitLab CI — .gitlab-ci.yml (stages/jobs; GitLab'ga qurilgan)
  Jenkins   — Jenkinsfile (o'z serveri; eski, kuchli, plugin ko'p)
  CircleCI  — .circleci/config.yml (SaaS)

   Tushuncha KO'CHADI: pipeline/stage/job/artifact — hamma joyda bir xil

JOY 2.3-bob:  .github/workflows/ci.yml  (YAML, 2 probel indent, tab YO'Q)
TRIGGER 2.5-bob: on: push|pull_request|schedule(cron)|workflow_dispatch
FILTR 2.5-bob:   branches: [main] | paths: ["src/**"] | tags: ["v*"]
JOB 2.2-bob:     jobs: <id>: runs-on: ubuntu-latest, steps: [...]
NEEDS 2.6-bob:   needs: [lint, test]  (sequential — o'tgach ishlaydi)
MATRIX 2.6-bob:  strategy: matrix: node: [18,20,22]  (parallel ko'p versiya)
ACTION 2.7-bob:  uses: actions/checkout@v4  |  with: { key: val }
BUYRUQ 2.3-bob:  run: npm ci  |  run: |  (ko'p qatorli)
SECRET 2.8-bob:  ${{ secrets.SSH_KEY }}  |  GITHUB_TOKEN (avto)
PERMS 2.8-bob:   permissions: { contents: read, packages: write }
CACHE 2.9-bob:   setup-node with cache:"npm"  |  actions/cache@v4
ARTIFACT 2.9-bob: upload-artifact@v4 / download-artifact@v4
ENV 2.10-bob:    environment: production  (approval gate)
CONCURR 2.13-bob: concurrency: { group: ..., cancel-in-progress: true }
OIDC 2.14-bob:   permissions: id-token: write  (parolsiz bulut)
COMPOSITE 2.15-bob: action.yml  using: composite  (step'lar bloki)
KONTEKST:      ${{ github.sha }} ${{ github.ref }} ${{ env.X }}
IF (shart):    if: github.ref == 'refs/heads/main'

# .github/workflows/ci.yml — eng oddiy CI (boshlang'ich)
name: CI                                    # workflow nomi (UI'da ko'rinadi)

on:                                         # QACHON ishga tushadi (2.5)
  push:
    branches: [main]                        # main'ga push'da
  pull_request:                             # va har PR'da (4.3)
    branches: [main]

jobs:
  test:                                     # job ID (o'zing tanlaysan)
    runs-on: ubuntu-latest                  # GitHub-hosted Linux runner (2.4)
    steps:
      - uses: actions/checkout@v4           # 1. kodni runner'ga ol (MAJBURIY birinchi)
      - uses: actions/setup-node@v4         # 2. Node.js o'rnat (2.7)
        with:
          node-version: "20"                # qaysi Node versiyasi
          cache: "npm"                      # npm keshini avto boshqar (tezlik — 2.9)
      - run: npm ci                         # 3. paket o'rnat (lockfile'dan — aniq, 5.2)
      - run: npm run lint                   # 4. ESLint (kod sifati — 15.3)
      - run: npm test                       # 5. testlar (Jest — 8.11)
#  Birorta qadam FAIL bo'lsa  butun job qizil  PR'da "X" belgi

# Kutubxonani bir nechta Node versiyada sinash (kengroq mosllik — 2.6)
name: Matrix CI
on: [push, pull_request]                    # qisqa shakl (har ikkisida)

jobs:
  test:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false                      # bittasi fail bo'lsa, boshqalar TO'XTAMASIN
      matrix:
        node-version: [18, 20, 22]          # 3 ta Node — 3 ta PARALLEL job
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}   # matrix qiymatini ol
          cache: "npm"
      - run: npm ci
      - run: npm test
#  matrix  3 ta alohida job (Node 18, 20, 22) — bir vaqtda (tez)
#  fail-fast:false  Node 18 yiqilsa ham, 20/22 davom etadi (to'liq ko'rinish)

# Ilovani Linux + Windows + macOS'da sinash (cross-platform — 2.6)
jobs:
  test:
    runs-on: ${{ matrix.os }}               # matrix'dan runner tanlanadi
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest, macos-latest]
        node-version: [20, 22]              # OS × Node = 3×2 = 6 ta job
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
      - run: npm ci
      - run: npm test
#  matrix kombinatsiya: 3 OS × 2 Node = 6 parallel job (to'liq qamrov)

# Build qil, dist/ ni artifact sifatida saqla (keyingi job/yuklab olish)
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: "20", cache: "npm" }
      - run: npm ci
      - run: npm run build                  # dist/ papka hosil bo'ladi (TS compile)
      - uses: actions/upload-artifact@v4    # dist/ ni SAQLA (2.9)
        with:
          name: dist                        # artifact nomi
          path: dist/                       # qaysi papka/fayl
          retention-days: 7                 # 7 kun saqlanadi (keyin o'chadi)
#  Endi run sahifasidan "dist" yuklab olinadi, yoki boshqa job download qiladi

# Docker image qurib, GitHub Container Registry (ghcr.io)'ga push
name: Docker Build
on:
  push:
    branches: [main]

jobs:
  docker:
    runs-on: ubuntu-latest
    permissions:                            # GITHUB_TOKEN huquqlari (eng kam — 2.8)
      contents: read
      packages: write                       # GHCR'ga push uchun MAJBURIY
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3 # Buildx (kesh/multi-platform — 2.7)
      - uses: docker/login-action@v3        # registry'ga login (10.4)
        with:
          registry: ghcr.io                 # GitHub Container Registry
          username: ${{ github.actor }}     # joriy foydalanuvchi (avto)
          password: ${{ secrets.GITHUB_TOKEN }}   # avto token (PAT kerak emas — 2.8)
      - uses: docker/build-push-action@v6   # qurish + push (10.3)
        with:
          context: .                        # Dockerfile qayerda
          push: true                        # qurgach push qil
          tags: ghcr.io/${{ github.repository }}:latest   # image tegi
#  ghcr.io/owner/repo:latest — endi server bu image'ni pull qiladi (10.4)

# main'ga push'da serverga SSH orqali deploy (10.1: 2.8)
name: Deploy
on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: appleboy/ssh-action@v1        # SSH orqali serverda buyruq (2.7)
        with:
          host: ${{ secrets.SERVER_HOST }}        # server IP (secret — 2.8)
          username: ${{ secrets.SERVER_USER }}    # deploy user (10.1: 2.4)
          key: ${{ secrets.SSH_PRIVATE_KEY }}     # private kalit (secret — 10.1: 2.8)
          script: |                               # serverda bajariladigan buyruqlar
            cd /home/deploy/app
            git pull origin main                  # yangi kodni tort
            npm ci --omit=dev                      # prod paketlar
            npm run build
            sudo systemctl restart myapp           # ilovani qayta yoq (10.1: 2.6)
#  SSH_PRIVATE_KEY repo secret'da; serverda public kalit authorized_keys'da (10.1: 2.9)

# Har PR'da test ishlaydi  yashil/qizil belgi (branch protection bilan — 2.12)
name: PR Check
on:
  pull_request:
    branches: [main]                        # main'ga qaratilgan PR'lar

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: "20", cache: "npm" }
      - run: npm ci
      - run: npm run lint                   # ESLint
      - run: npm run test:cov               # test + coverage (8.11)
      - run: npm run build                  # build ham buzilmasin
#  Bu job "validate"  branch protection'da REQUIRED qil (2.12)
#  qizil bo'lsa PR MERGE bo'lmaydi (buzuq kod main'ga kirmaydi — 4.3)

# To'liq CI/CD: parallel tekshiruv  build  deploy (needs bilan — 2.6, 2.11)
name: CI/CD Pipeline
on:
  push:
    branches: [main]

jobs:
  lint:                                     # 1-job (parallel)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: "20", cache: "npm" }
      - run: npm ci
      - run: npm run lint

  test:                                     # 2-job (lint bilan PARALLEL)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: "20", cache: "npm" }
      - run: npm ci
      - run: npm test

  deploy:                                   # 3-job (SEQUENTIAL — oxirgi)
    needs: [lint, test]                     # lint VA test o'tgach (2.6)
    runs-on: ubuntu-latest
    environment: production                 # approval gate (2.10)
    steps:
      - uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: "cd /app && docker compose pull && docker compose up -d"  # 10.4
#  lint/test PARALLEL (tez)  ikkalasi o'tsa  deploy (approval kutadi — 2.10)

# === .github/workflows/reusable-test.yml (UMUMIY — bir marta yoziladi) ===
name: Reusable Test
on:
  workflow_call:                            # boshqa workflow CHAQIRA oladi (2.12)
    inputs:
      node-version:
        type: string
        default: "20"
jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: ${{ inputs.node-version }}, cache: "npm" }
      - run: npm ci
      - run: npm test

# === .github/workflows/ci.yml (CHAQIRUVCHI) ===
# on: [push]
# jobs:
#   call-test:
#     uses: ./.github/workflows/reusable-test.yml   # umumiyni chaqir
#     with: { node-version: "22" }
#     secrets: inherit                              # secret'larni uzat
#  10 ta repo'da bir xil CI o'rniga — 1 umumiy, hammasi chaqiradi (DRY — 15.1)

# Qo'lda ishga tushiriladigan deploy — qaysi muhitga tanlash bilan
name: Manual Deploy
on:
  workflow_dispatch:                        # UI'dan "Run workflow" tugmasi (2.5)
    inputs:
      target:
        description: "Qaysi muhitga deploy?"
        type: choice
        options: [staging, production]      # tanlov ro'yxati
        default: staging

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: ${{ inputs.target }}       # tanlangan muhit (approval — 2.10)
    steps:
      - uses: actions/checkout@v4
      - name: Deploy xabari
        run: echo "Deploy  ${{ inputs.target }} (commit ${{ github.sha }})"
      - uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SSH_PRIVATE_KEY }}
          script: "cd /app && ./deploy.sh ${{ inputs.target }}"
#  production tanlansa — environment qoidasi approval so'raydi (2.10)

# Takror run'larni bekor qiluvchi, coverage artifact chiqaruvchi CI (2.13, 2.9)
name: CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

concurrency:                                # takror run'larni bekor qil (2.13)
  group: ci-${{ github.ref }}               # branch/PR bo'yicha guruh
  cancel-in-progress: true                  # eski (tugamagan) run to'xtaydi

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: "20", cache: "npm" }
      - run: npm ci
      - run: npm run lint

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: "20", cache: "npm" }
      - run: npm ci
      - run: npm run test:cov               # test + coverage hisobot (8.11)
      - uses: actions/upload-artifact@v4    # coverage'ni artifact qil (2.9)
        with:
          name: coverage
          path: coverage/
          retention-days: 7

  build:
    needs: [lint, test]                     # ikkalasi o'tgach (2.6)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: "20", cache: "npm" }
      - run: npm ci
      - run: npm run build
#  PR'ga tez commit qilinsa — eski run bekor bo'ladi (faqat oxirgisi — 2.13)

# === .github/actions/setup/action.yml (composite — bir marta yoziladi) ===
name: "Setup Node loyihasi"
description: "Node o'rnatadi, kesh bilan paketlarni tortadi"
inputs:
  node-version:
    default: "20"
runs:
  using: composite                          # composite action (2.15)
  steps:
    - uses: actions/setup-node@v4
      with:
        node-version: ${{ inputs.node-version }}
        cache: "npm"
    - run: npm ci
      shell: bash                           # composite'da shell MAJBURIY (2.15)

# === .github/workflows/ci.yml (ishlatuvchi) ===
# jobs:
#   test:
#     runs-on: ubuntu-latest
#     steps:
#       - uses: actions/checkout@v4
#       - uses: ./.github/actions/setup      # composite'ni ulash (checkout+node+ci)
#         with: { node-version: "22" }
#       - run: npm test
#  checkout+setup-node+npm ci takrori — bitta action'ga o'raldi (DRY — 2.15)

# AWS'ga SECRET'siz deploy — OIDC qisqa muddatli token bilan
name: Deploy AWS
on:
  push:
    branches: [main]

permissions:
  id-token: write                           # OIDC token so'rash MAJBURIY (2.14)
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production                  # approval gate (2.10)
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4   # OIDC  AWS rol (2.14)
        with:
          role-to-assume: arn:aws:iam::123456789012:role/gha-deploy
          aws-region: eu-central-1
      - run: aws s3 sync ./dist s3://my-app-bucket --delete   # S3'ga yuklash (10.6)
#  Hech qanday AWS secret YO'Q — GitHub token AWS roliga almashadi (2.14)

# Docker image'ni tez qurish (layer cache) + izlanadigan SHA teg (rollback — 2.17)
name: Docker
on:
  push:
    branches: [main]

concurrency:
  group: docker-${{ github.ref }}
  cancel-in-progress: false                 # image qurishni o'rtada bekor qilma

jobs:
  docker:
    runs-on: ubuntu-latest
    permissions: { contents: read, packages: write }   # GHCR push (2.8)
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: docker/build-push-action@v6
        with:
          context: .
          push: true
          tags: |                            # IKKI teg — latest va aniq SHA
            ghcr.io/${{ github.repository }}:latest
            ghcr.io/${{ github.repository }}:${{ github.sha }}   # rollback uchun (2.17)
          cache-from: type=gha               # GitHub Actions cache'dan o'qi (2.9)
          cache-to: type=gha,mode=max        # layer'larni cache'ga yoz (tez qayta qurish)
#  :${{ github.sha }} — rollback = serverda oldingi SHA image'ni yoqish (2.17)

# === .github/dependabot.yml (bog'liqliklarni kuzatadi — PR ochadi) ===
version: 2
updates:
  - package-ecosystem: "npm"                # npm paketlari
    directory: "/"
    schedule:
      interval: "weekly"                    # har hafta yangilanish tekshiradi
  - package-ecosystem: "github-actions"     # action versiyalarini ham kuzat
    directory: "/"
    schedule:
      interval: "weekly"

# === .github/workflows/codeql.yml (statik xavfsizlik tahlili) ===
# name: CodeQL
# on:
#   push: { branches: [main] }
#   schedule: [{ cron: "0 3 * * 1" }]        # har dushanba 03:00 UTC (2.5)
# jobs:
#   analyze:
#     runs-on: ubuntu-latest
#     permissions: { security-events: write, contents: read }
#     steps:
#       - uses: actions/checkout@v4
#       - uses: github/codeql-action/init@v3
#         with: { languages: javascript }
#       - uses: github/codeql-action/analyze@v3
#  Dependabot = paket zaifligi PR ; CodeQL = kod zaifligi (Security tab — 2.18)

 uses: actions/checkout@main (har o'zgarishda buzilishi mumkin — 2.7)
 uses: actions/checkout@v4 (versiya qadalgan — barqaror)

 run: echo ${{ secrets.DB_PASSWORD }} (log'ga chiqishi xavfi — 2.8)
 env: DB_PASSWORD: ${{ secrets.DB_PASSWORD }} (env orqali, log'da ***)

 npm install (lockfile yangilanadi, har run boshqa versiya — 5.2)
 npm ci (lockfile'dan AYNAN, takrorlanadigan, tez — CI uchun)

 build job dist/ qurdi, deploy job ishlatadi (toza mashina — KO'RMAYDI — 2.6)
 upload-artifact (build)  download-artifact (deploy) — 2.9

 deploy avval, test keyin (buzuq kod chiqib ketadi — 2.11)
 needs: [test] — test o'tgach deploy (CI gate — 2.6)

 har push avtomatik production'ga (xato darrov foydalanuvchida — 2.10)
 environment: production + required reviewers (approval gate)

 permissions: write-all (haddan ortiq huquq — xavf — 2.8)
 permissions: { contents: read, packages: write } (eng kam — 10.1: 2.4)