CI/CD for Beginners

          Developer pushes a code change
                         |
                         v
          +------------------------------+
          | 1. SOURCE                    |
          | Git repo detects the change  |
          +------------------------------+
                         |
                         v
          +------------------------------+
          | 2. BUILD                     |
          | Install deps, package code   |
          +------------------------------+
                         |
                         v
          +------------------------------+
          | 3. TEST                      |
          | Lint, unit tests, scans      |
          +------------------------------+
                         |
                         v
                  < Tests pass? >
                 /               \
              NO /                 \ YES
                v                   v
 +-----------------+      +--------------------------+
 | STOP            |      | Manual approval          |
 | Pipeline fails, |      | (Continuous Delivery     |
 | developer is    |      | only; skipped in         |
 | notified        |      | Continuous Deployment)   |
 +-----------------+      +--------------------------+
          |                             |
          v                             v
 Developer fixes the code   +--------------------------+
 and pushes again           | 4. DEPLOY                |
 (back to step 1)           | S3, Lambda, EC2, ...     |
                            +--------------------------+
                                        |
                                        v
                            +--------------------------+
                            | 5. MONITOR               |
                            | CloudWatch, logs,        |
                            | rollback                 |
                            +--------------------------+
                                        |
                                        v
                            Feedback for the next change
                            (back to step 1)


         You edit app.py and run: git push to main
                            |
                            v
              GitHub Actions starts (deploy.yml)
                            |
 ------------------ JOB 1: test (CI) ------------------
                            |
                            v
              Set up Python, install dev tools
                            |
                            v
                   flake8 (style check)
                            |
                            v
                   pytest (unit tests)
                            |
                            v
                  < All checks pass? >
                 /                    \
              NO /                      \ YES  (needs: test)
                v                         |
 +--------------------+                   |
 | STOP               |                   |
 | Deploy job skipped |                   |
 | Live function is   |                   |
 | unchanged          |                   |
 | You get a failure  |                   |
 | notification       |                   |
 +--------------------+                   |
                                          v
 ------------------ JOB 2: deploy (CD) ----------------
                            |
                            v
               Request a GitHub OIDC token
                            |
                            v
          AWS STS checks the token against the role's
          trust policy (repo + branch) and returns
          TEMPORARY credentials
                            |
                            v
                 Zip the code (function.zip)
                            |
                            v
              aws lambda update-function-code
                            |
                            v
              aws lambda wait function-updated
                            |
                            v
          Smoke test: invoke the function and
          check the answer
                            |
                            v
                   < Correct result? >
                  /                    \
             YES /                      \ NO
                v                         v
 +-----------------------+   +---------------------------+
 | LIVE                  |   | ALERT                     |
 | New version is        |   | Deploy ran but the smoke  |
 | running               |   | test failed: roll back    |
 +-----------------------+   | (git revert, push)        |
                             +---------------------------+


wordcount-pipeline/
├── app.py
├── requirements-dev.txt
├── setup.cfg
├── tests/
│   └── test_app.py
└── .github/
    └── workflows/
        └── deploy.yml


import json

def count_words(text):
    """Return the number of words in a piece of text."""
    return len(text.split())

def lambda_handler(event, context):
    """AWS Lambda entry point: reads 'text' from the event and returns its word count."""
    text = event.get("text", "")
    return {
        "statusCode": 200,
        "body": json.dumps({"words": count_words(text)}),
    }


import json

from app import count_words, lambda_handler

def test_count_words_simple():
    assert count_words("hello cloud world") == 3

def test_count_words_empty():
    assert count_words("") == 0

def test_count_words_extra_spaces():
    assert count_words("  many   spaces here ") == 3

def test_lambda_handler_returns_json_body():
    response = lambda_handler({"text": "ci cd on aws"}, None)
    assert response["statusCode"] == 200
    assert json.loads(response["body"]) == {"words": 4}


pytest
flake8


[flake8]
max-line-length = 100
exclude = .git,__pycache__,.venv


python -m venv .venv
source .venv/bin/activate          # on Windows: .venv\Scripts\activate
pip install -r requirements-dev.txt
flake8 .
python -m pytest


{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::<ACCOUNT_ID>:oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
        },
        "StringLike": {
          "token.actions.githubusercontent.com:sub": "repo:<GITHUB_OWNER>/<REPO_NAME>:ref:refs/heads/main"
        }
      }
    }
  ]
}


{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "lambda:UpdateFunctionCode",
        "lambda:GetFunction",
        "lambda:GetFunctionConfiguration",
        "lambda:InvokeFunction"
      ],
      "Resource": "arn:aws:lambda:<REGION>:<ACCOUNT_ID>:function:wordcounter"
    }
  ]
}


name: Test and deploy

on:
  push:
    branches: [main]
  workflow_dispatch:

permissions:
  id-token: write   # allows the job to request the OIDC token
  contents: read

env:
  FUNCTION_NAME: wordcounter
  AWS_REGION: <YOUR_REGION>

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install dev tools
        run: pip install -r requirements-dev.txt

      - name: Lint with flake8
        run: flake8 .

      - name: Run unit tests
        run: python -m pytest

  deploy:
    needs: test            # only runs if the test job succeeded
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Configure AWS credentials (OIDC)
        uses: aws-actions/configure-aws-credentials@v6
        with:
          role-to-assume: arn:aws:iam::<ACCOUNT_ID>:role/<ROLE_NAME>
          aws-region: ${{ env.AWS_REGION }}

      - name: Package the code
        run: zip function.zip app.py

      - name: Update the Lambda function
        run: aws lambda update-function-code --function-name "$FUNCTION_NAME" --zip-file fileb://function.zip

      - name: Wait for the update to finish
        run: aws lambda wait function-updated --function-name "$FUNCTION_NAME"

      - name: Smoke test the live function
        run: |
          aws lambda invoke --function-name "$FUNCTION_NAME" --cli-binary-format raw-in-base64-out --payload '{"text": "ci cd on aws"}' response.json
          python3 -c "import json; r = json.load(open('response.json')); assert json.loads(r['body'])['words'] == 4, r"


def count_words(text):
    return len(text)      # bug: counts characters, not words


git revert HEAD
git push


      - name: Upload to S3
        run: aws s3 sync . s3://<BUCKET_NAME> --delete --exclude ".git/*" --exclude ".github/*"


version: 0.2

phases:
  install:
    commands:
      - pip install -r requirements-dev.txt
  build:
    commands:
      - flake8 .
      - python -m pytest

artifacts:
  files:
    - app.py


version: 0.0
os: linux
files:
  - source: /
    destination: /var/www/html
hooks:
  AfterInstall:
    - location: scripts/restart_server.sh
      timeout: 60
      runas: root