Multi-Cloud CI/CD Pipeline Comparison

version: 0.2

env:
  variables:
    ENVIRONMENT: production
  parameter-store:
    DB_PASSWORD: /app/prod/db-password
  exported-variables:
    - IMAGE_TAG

phases:
  install:
    runtime-versions:
      nodejs: 20
    commands:
      - npm ci --cache .npm
  pre_build:
    commands:
      - echo Logging in to ECR...
      - aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com
      - export IMAGE_TAG=$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | head -c 8)
  build:
    commands:
      - echo Running tests...
      - npm test -- --coverage --ci
      - echo Building Docker image...
      - docker build -t $REPOSITORY_URI:$IMAGE_TAG .
      - docker tag $REPOSITORY_URI:$IMAGE_TAG $REPOSITORY_URI:latest
  post_build:
    commands:
      - docker push $REPOSITORY_URI:$IMAGE_TAG
      - docker push $REPOSITORY_URI:latest
      - printf '[{"name":"app","imageUri":"%s"}]' $REPOSITORY_URI:$IMAGE_TAG > imagedefinitions.json

artifacts:
  files:
    - imagedefinitions.json
    - appspec.yaml
    - taskdef.json

cache:
  paths:
    - .npm/**/*
    - node_modules/**/*

# Create a CodePipeline V2 pipeline with Git push trigger
aws codepipeline create-pipeline --cli-input-json file://pipeline.json

# pipeline.json key sections:
# - pipelineType: V2
# - triggers: [{ providerType: "CodeStarSourceConnection", gitConfiguration: { push: [{ branches: { includes: ["main"] } }] } }]
# - stages: Source -> Build -> Deploy

# Monitor pipeline execution
aws codepipeline get-pipeline-execution \
  --pipeline-name my-app-pipeline \
  --pipeline-execution-id <execution-id>

trigger:
  branches:
    include:
      - main
  paths:
    exclude:
      - docs/**
      - README.md

pool:
  vmImage: ubuntu-latest

variables:
  - group: production-secrets
  - name: imageName
    value: myapp
  - name: dockerRegistry
    value: myregistry.azurecr.io

stages:
  - stage: Build
    displayName: Build & Test
    jobs:
      - job: BuildJob
        steps:
          - task: NodeTool@0
            inputs:
              versionSpec: '20.x'

          - script: |
              npm ci
              npm run lint
              npm test -- --coverage
            displayName: Install, lint, and test

          - task: Docker@2
            displayName: Build and push image
            inputs:
              containerRegistry: acr-service-connection
              repository: $(imageName)
              command: buildAndPush
              Dockerfile: '**/Dockerfile'
              tags: |
                $(Build.BuildId)
                latest

  - stage: DeployStaging
    displayName: Deploy to Staging
    dependsOn: Build
    condition: succeeded()
    jobs:
      - deployment: DeployStaging
        environment: staging
        strategy:
          runOnce:
            deploy:
              steps:
                - task: AzureWebAppContainer@1
                  inputs:
                    azureSubscription: azure-prod-connection
                    appName: myapp-staging
                    containers: $(dockerRegistry)/$(imageName):$(Build.BuildId)

  - stage: DeployProduction
    displayName: Deploy to Production
    dependsOn: DeployStaging
    condition: succeeded()
    jobs:
      - deployment: DeployProduction
        environment: production  # Has approval gate configured
        strategy:
          runOnce:
            deploy:
              steps:
                - task: AzureWebAppContainer@1
                  inputs:
                    azureSubscription: azure-prod-connection
                    appName: myapp-production
                    containers: $(dockerRegistry)/$(imageName):$(Build.BuildId)

steps:
  # Install dependencies and run tests
  - name: 'node:20'
    entrypoint: npm
    args: ['ci']
    id: install

  - name: 'node:20'
    entrypoint: npm
    args: ['test', '--', '--coverage', '--ci']
    waitFor: ['install']
    id: test

  - name: 'node:20'
    entrypoint: npm
    args: ['run', 'lint']
    waitFor: ['install']
    id: lint

  # Build and push container image
  - name: 'gcr.io/cloud-builders/docker'
    args:
      - build
      - '-t'
      - 'us-central1-docker.pkg.dev/$PROJECT_ID/app-repo/myapp:$SHORT_SHA'
      - '-t'
      - 'us-central1-docker.pkg.dev/$PROJECT_ID/app-repo/myapp:latest'
      - '--cache-from'
      - 'us-central1-docker.pkg.dev/$PROJECT_ID/app-repo/myapp:latest'
      - '.'
    waitFor: ['test', 'lint']
    id: build

  - name: 'gcr.io/cloud-builders/docker'
    args:
      - push
      - '--all-tags'
      - 'us-central1-docker.pkg.dev/$PROJECT_ID/app-repo/myapp'
    waitFor: ['build']
    id: push

  # Create Cloud Deploy release
  - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
    entrypoint: gcloud
    args:
      - deploy
      - releases
      - create
      - 'release-$SHORT_SHA'
      - '--delivery-pipeline=myapp-pipeline'
      - '--region=us-central1'
      - '--images=myapp=us-central1-docker.pkg.dev/$PROJECT_ID/app-repo/myapp:$SHORT_SHA'
    waitFor: ['push']

options:
  machineType: E2_HIGHCPU_8
  logging: CLOUD_LOGGING_ONLY

timeout: 1200s

images:
  - 'us-central1-docker.pkg.dev/$PROJECT_ID/app-repo/myapp:$SHORT_SHA'

apiVersion: deploy.cloud.google.com/v1
kind: DeliveryPipeline
metadata:
  name: myapp-pipeline
serialPipeline:
  stages:
    - targetId: staging
      profiles: [staging]
      strategy:
        standard:
          verify: true
    - targetId: production
      profiles: [production]
      strategy:
        canary:
          runtimeConfig:
            kubernetes:
              serviceNetworking:
                service: myapp-service
                deployment: myapp
          canaryDeployment:
            percentages: [10, 25, 50]
            verify: true
---
apiVersion: deploy.cloud.google.com/v1
kind: Target
metadata:
  name: staging
gke:
  cluster: projects/my-project/locations/us-central1/clusters/staging-cluster
---
apiVersion: deploy.cloud.google.com/v1
kind: Target
metadata:
  name: production
gke:
  cluster: projects/my-project/locations/us-central1/clusters/prod-cluster
requireApproval: true

name: Multi-Cloud Deploy

on:
  push:
    branches: [main]

permissions:
  id-token: write
  contents: read

env:
  APP_VERSION: ${{ github.sha }}

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm
      - run: npm ci
      - run: npm test -- --coverage

  deploy-aws:
    needs: test
    runs-on: ubuntu-latest
    environment: aws-production
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789012:role/github-deploy
          aws-region: us-east-1
      - uses: aws-actions/amazon-ecr-login@v2
      - run: |
          docker build -t ${{ env.ECR_REGISTRY }}/app:${{ env.APP_VERSION }} .
          docker push ${{ env.ECR_REGISTRY }}/app:${{ env.APP_VERSION }}
      - run: |
          aws ecs update-service \
            --cluster production \
            --service app-service \
            --force-new-deployment

  deploy-azure:
    needs: test
    runs-on: ubuntu-latest
    environment: azure-production
    steps:
      - uses: actions/checkout@v4
      - uses: azure/login@v2
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      - uses: azure/docker-login@v2
        with:
          login-server: myregistry.azurecr.io
      - run: |
          docker build -t myregistry.azurecr.io/app:${{ env.APP_VERSION }} .
          docker push myregistry.azurecr.io/app:${{ env.APP_VERSION }}
      - uses: azure/webapps-deploy@v3
        with:
          app-name: myapp-production
          images: myregistry.azurecr.io/app:${{ env.APP_VERSION }}

  deploy-gcp:
    needs: test
    runs-on: ubuntu-latest
    environment: gcp-production
    steps:
      - uses: actions/checkout@v4
      - uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: projects/123/locations/global/workloadIdentityPools/github/providers/github
          service_account: deploy@my-project.iam.gserviceaccount.com
      - uses: google-github-actions/setup-gcloud@v2
      - run: gcloud auth configure-docker us-central1-docker.pkg.dev
      - run: |
          docker build -t us-central1-docker.pkg.dev/my-project/repo/app:${{ env.APP_VERSION }} .
          docker push us-central1-docker.pkg.dev/my-project/repo/app:${{ env.APP_VERSION }}
      - run: |
          gcloud run deploy app-service \
            --image us-central1-docker.pkg.dev/my-project/repo/app:${{ env.APP_VERSION }} \
            --region us-central1

stages:
  - test
  - build
  - deploy

variables:
  IMAGE_NAME: myapp
  DOCKER_TLS_CERTDIR: "/certs"

test:
  stage: test
  image: node:20
  cache:
    key: $CI_COMMIT_REF_SLUG
    paths:
      - node_modules/
  script:
    - npm ci
    - npm run lint
    - npm test -- --coverage
  coverage: '/All files.*?(d+\.\d+)%/'

build:
  stage: build
  image: docker:24
  services:
    - docker:24-dind
  script:
    - docker build -t $IMAGE_NAME:$CI_COMMIT_SHORT_SHA .
    - docker tag $IMAGE_NAME:$CI_COMMIT_SHORT_SHA $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    - docker tag $IMAGE_NAME:$CI_COMMIT_SHORT_SHA $CI_REGISTRY_IMAGE:latest
    - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA
    - docker push $CI_REGISTRY_IMAGE:latest

deploy-aws:
  stage: deploy
  image: amazon/aws-cli:latest
  id_tokens:
    AWS_OIDC_TOKEN:
      aud: https://gitlab.com
  script:
    - >
      export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s"
      $(aws sts assume-role-with-web-identity
      --role-arn arn:aws:iam::123456789012:role/gitlab-deploy
      --role-session-name gitlab-ci
      --web-identity-token $AWS_OIDC_TOKEN
      --query "Credentials.[AccessKeyId,SecretAccessKey,SessionToken]"
      --output text))
    - aws ecs update-service --cluster prod --service app --force-new-deployment
  environment:
    name: aws-production
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

deploy-gcp:
  stage: deploy
  image: google/cloud-sdk:latest
  id_tokens:
    GCP_OIDC_TOKEN:
      aud: https://iam.googleapis.com/projects/123/locations/global/workloadIdentityPools/gitlab/providers/gitlab
  script:
    - echo $GCP_OIDC_TOKEN > /tmp/oidc_token
    - gcloud iam workload-identity-pools create-cred-config
        projects/123/locations/global/workloadIdentityPools/gitlab/providers/gitlab
        --service-account=deploy@project.iam.gserviceaccount.com
        --credential-source-file=/tmp/oidc_token
        --output-file=/tmp/creds.json
    - export GOOGLE_APPLICATION_CREDENTIALS=/tmp/creds.json
    - gcloud run deploy app --image $CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA --region us-central1
  environment:
    name: gcp-production
  rules:
    - if: $CI_COMMIT_BRANCH == "main"