[CI/CD] Set Up GitHub Actions Workflow for Testing, Linting, and Automated Deployment

[KarenZita01]

Description

The project requires a fully automated CI/CD pipeline using GitHub Actions to ensure code quality, run tests, perform linting, and deploy the application to a staging or production environment. This issue creates a comprehensive workflow configuration that triggers on pushes to main and develop branches, as well as pull requests targeting these branches.

The CI pipeline must include the following jobs: lint (run ESLint or equivalent code style checks), test (execute all unit and integration tests), build (verify the application starts without errors), security-scan (basic dependency vulnerability audit with npm audit), and deploy (conditional on branch — deploy to staging from develop, deploy to production from main only after all preceding jobs pass).

The deployment job should support deploying to a cloud platform (Heroku, Railway, or any platform-agnostic deployment via SSH or API). For the initial implementation, a placeholder deployment step is acceptable, but the workflow must be structured to allow easy addition of deployment targets later. Caching of node_modules and npm cache should be implemented to speed up subsequent runs. Secrets management must use GitHub Secrets (e.g., DEPLOY_TOKEN, DEPLOY_URL, SSH_KEY).

Technical Context & Impact

• Dependencies: GitHub repository with GitHub Actions enabled. No additional npm dependencies. The workflow file is YAML and lives at .github/workflows/ci.yml.
• Architecture: Workflow consists of a single ci.yml file with multiple jobs running in parallel where possible. The deploy job depends on lint, test, build, and security-scan completing successfully.
• Impact: This is a critical DevOps issue. Manual deployment and testing are error-prone and time-consuming. An automated pipeline ensures consistent quality gates, reduces human error, and enables rapid iteration. Blocking PR merges on CI passing becomes the team standard.

Step-by-Step Implementation Guide

1. Create Workflow Directory: Create .github/workflows/ directory in the project root.
2. Write CI Workflow: Create .github/workflows/ci.yml with: name: CI/CD. Trigger on push and pull_request to main and develop. Set environment variables: NODE_VERSION: 20.x. Configure jobs: lint, test, build, security-scan, deploy.
3. Configure Job Steps: Each job checks out code, sets up Node.js with caching (actions/setup-node with cache: 'npm'), runs npm ci for clean install. Lint job: runs npx eslint . (install ESLint if needed). Test job: runs npm test. Build job: runs node -e "require('./src/index.js')" or similar startup check. Security job: runs npm audit --audit-level=high. Deploy job: runs a deploy script (placeholder or actual).
4. Add ESLint Configuration: If not already present, add .eslintrc.json with recommended rules for Node.js. Install eslint as devDependency with npm install --save-dev eslint.
5. Test the Workflow: Push to a develop branch on the repository and verify the workflow runs on GitHub. Fix any failures in linting or tests.
6. Add Status Badges: Optionally add workflow status badges to the README.md for visibility.

Verification & Testing Steps

1. Push the workflow file to the develop branch on GitHub and navigate to the Actions tab — verify the workflow is triggered and all jobs (lint, test, build, security) complete successfully.
2. Create a pull request from develop to main — verify the workflow runs on the PR and status checks appear on the PR page.
3. Introduce a deliberate lint error (e.g., unused variable) and push — verify the lint job fails, blocking the workflow.
4. Verify that npm cache and node_modules are cached between runs — confirm the second run is faster by checking the log for cache hit messages.
5. Check that the security-scan job reports any high-severity vulnerabilities found by npm audit.

[SudiptaPaul-31]

May I be assigned to this issue please my name is Sudipta Paul a active open source contributor with more than 50+ merged pr's and also an active contributor of GrantFox from beginning and would love to work on this issue and get a pr merged

[grantfox-oss]

🦊 GrantFox — @SudiptaPaul-31 has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #9)
2. Your PR will be reviewed by the EquipChain maintainers

Good luck! Track your progress on GrantFox.