Stage 1: Test and Lint (Every PR)
Node.js 22 with npm ci for reproducible dependency installation. ESLint with our shared TypeScript config. Vitest for unit and integration tests with 80% minimum coverage enforcement on core business logic. TypeScript type checking with tsc –noEmit to catch type errors in CI before they reach code review.
Stage 2: Build and Security Scan
Docker multi-stage build producing a non-root container image under 100MB. Trivy image scan — the pipeline fails on any HIGH or CRITICAL severity CVE findings. The image is tagged with the git commit SHA (never “latest”) and pushed to Amazon ECR.
Stage 3: Staging Deploy
ECS service updated with the new image tag via the AWS CLI. Pipeline waits for service steady state (new tasks healthy, old tasks drained). A 10-endpoint smoke test suite runs against the staging URL to validate the deployment before any production gate proceeds.
Stage 4: Blue-Green Production Deploy
Runs only on pushes to the main branch after staging smoke tests pass. The Application Load Balancer shifts traffic from the blue (current) target group to the green (new) target group over 5 minutes. If green health checks fail during the traffic shift, the ALB automatically returns all traffic to blue — zero-downtime automatic rollback.
Manual Rollback
One AWS CLI command updates the ECS service to the previous task definition revision. We retain the last 5 task definition revisions at all times.