Phase 04 — Product Operations
CI/CD pipeline, GMUD, deployment strategy, SLOs and DORA metrics.
CI/CD Pipeline — GitHub Actions
Pipeline with 6 jobs defined in .github/workflows/ci.yml. Adapted to the real stack: npm (not pnpm), Fastify 5.0 (not tRPC/Next.js), SQLite3 in-memory for tests (not Supabase/PostgreSQL), Vitest (not Playwright).
Job 1
code-quality
Runs linting and TypeScript type checking on server and web.
lint— ESLint with standard rulestypecheck server— tsc --noEmit in server/ directorytypecheck web— tsc --noEmit in web/ directory
Job 2 — depends on code-quality
unit-tests
Runs unit tests via Vitest with SQLite3 in-memory.
server tests (Vitest)— 4 test files, 29 test cases covering auth, pix, accounts, paymentsweb tests (Vitest)— React component tests
Job 3 — depends on unit-tests
build
Production build of the React frontend.
vite build— generates web/dist/ with optimized static files (code splitting, tree shaking, minification)
Job 4 — conditional (main branch only)
change-gate
Verifies GMUD approval before allowing production deploy.
verify GMUD approval— checks if the corresponding GMUD has status "Approved"
Job 5 — depends on build + change-gate
deploy-production
Actual production deploy.
install— npm ci with production dependenciesbuild— TypeScript server compilationdeploy server— upload and restart Node.js process via PM2deploy web— upload static files (web/dist/)migrations— run SQLite3 database migrationssmoke test— post-deploy health check verification
Job 6 — always runs
quality-gate
Final gate that verifies all previous jobs passed. If any job fails, the pipeline is marked as failed.
GMUD-001 — Initial Release
Change Management
GMUD-001: Initial Release — ECP Digital Bank v3.0 (MVP)
| Type | Normal |
| Status | Approved |
| Risk | Low (6/30) |
| Planned Execution | 2026-03-05 10:00 BRT |
| Estimated Duration | 45 minutes |
| Components | Fastify API, React SPA, SQLite3, GitHub Actions, Environment variables |
| Rollback | SQLite backup + PM2 stop + static file replacement |
Deployment Strategy
API Server
Node.js + PM2
Node.js process managed by PM2 on a VPS/VM or platform like Railway, Render, or Fly.io.
- PM2 manages automatic restart, logs, and clustering
- SQLite3 as a local file on the same server
- Database backup before each deploy
- Rollback: PM2 rollback + restore SQLite file
Frontend SPA
Static Hosting
Static files (web/dist/) served via Vercel, Netlify, Cloudflare Pages, or Fastify itself.
- Build generates optimized HTML/CSS/JS
- CDN for global distribution
- Cache headers for immutable assets
- SPA fallback (index.html for all routes)
Environment Variables — Production
| Variable | Purpose | Required |
|---|---|---|
JWT_SECRET | Secret key for JWT token signing — NEVER use default value | Yes |
DATABASE_PATH | Path to SQLite file in production | Yes |
PORT | API port (default: 3333) | Yes |
NODE_ENV | production | Yes |
VITE_API_URL | Production API URL for frontend build | Yes (build) |
VERCEL_TOKEN | Automatic frontend deploy (if using Vercel) | Optional |
Service Level Objectives (SLOs)
Availability (API)
99.5%
Percentage of requests answered successfully (excluding client 4xx). Measured by uptime monitoring.
Latency (P95)
< 500ms
95% of API requests answered in less than 500ms. Measured via APM or access logs.
Error Rate
< 1%
Rate of 5xx responses over total requests. Excludes validation errors (4xx).
Auth Success Rate
> 99%
Success rate of login attempts with valid credentials. Failures indicate infrastructure issues.
LCP (Frontend)
< 2.5s
Largest Contentful Paint of the dashboard after login. Measured via Core Web Vitals.
CI Pipeline Duration
< 10min
Total pipeline time (code-quality + tests + build). Fast feedback goal for developers.
DORA Metrics — Targets (Elite Tier)
| Metric | Target | How to Measure |
|---|---|---|
| Deployment Frequency | On-demand (multiple per day) | Count of production deploys per day/week via GitHub Actions runs with success status on main branch. |
| Lead Time for Changes | < 1 hour | Time between PR merge to main and completed production deploy. Measured via GitHub Actions timestamps. |
| Change Failure Rate | < 5% | Percentage of deploys resulting in service degradation, rollback, or hotfix. Measured via GMUD registry. |
| Time to Restore Service (MTTR) | < 1 hour | Time between incident detection and service restoration. Measured via incident log with timestamps. |
Useful Links
Phase 04 HITL
| HITL | Scope | Agent | Decision |
|---|---|---|---|
| #11 | Operational infrastructure (CI/CD pipeline, GMUD-001, installation guide, SLOs) | Operations | Approved |