CI/CD Pipeline That Actually Works — From Push to Production in 12 Minutes

You: Create a GitLab CI pipeline for our monorepo:
- Frontend: Next.js (deploy to Vercel)
- Backend: Django + Python 3.12 (deploy to Render)
- Shared: PostgreSQL tests need a service container
- Want: lint, test (parallel), security scan, deploy staging,
  deploy prod (manual gate)

stages:
  - validate
  - test
  - security
  - build
  - deploy-staging
  - integration
  - deploy-production

variables:
  PIP_CACHE_DIR: "$CI_PROJECT_DIR/.pip-cache"
  NPM_CONFIG_CACHE: "$CI_PROJECT_DIR/.npm-cache"
  POSTGRES_DB: test_db
  POSTGRES_USER: test_user
  POSTGRES_PASSWORD: test_pass

# === VALIDATE STAGE ===
lint:frontend:
  stage: validate
  image: node:20-alpine
  cache:
    key: npm-${CI_COMMIT_REF_SLUG}
    paths: [.npm-cache, frontend/node_modules]
  script:
    - cd frontend && npm ci --cache .npm-cache
    - npm run lint
    - npm run type-check
  rules:
    - changes: [frontend/**/*]

lint:backend:
  stage: validate
  image: python:3.12-slim
  cache:
    key: pip-${CI_COMMIT_REF_SLUG}
    paths: [.pip-cache]
  script:
    - cd backend && pip install ruff
    - ruff check .
    - ruff format --check .
  rules:
    - changes: [backend/**/*]

# === TEST STAGE (parallel) ===
test:frontend:
  stage: test
  image: node:20-alpine
  cache:
    key: npm-${CI_COMMIT_REF_SLUG}
    paths: [.npm-cache, frontend/node_modules]
  script:
    - cd frontend && npm ci
    - npm run test -- --coverage --shard=$CI_NODE_INDEX/$CI_NODE_TOTAL
  parallel: 3
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: frontend/coverage/cobertura-coverage.xml

test:backend:
  stage: test
  image: python:3.12-slim
  services:
    - postgres:16-alpine
  variables:
    DATABASE_URL: "postgresql://test_user:test_pass@postgres:5432/test_db"
  cache:
    key: pip-${CI_COMMIT_REF_SLUG}
    paths: [.pip-cache]
  script:
    - cd backend && pip install -r requirements.txt
    - pytest --cov --cov-report=xml -n auto
  parallel: 2
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: backend/coverage.xml

# === SECURITY STAGE ===
sast:
  stage: security
  image: returntocorp/semgrep
  script:
    - semgrep scan --config=auto --sarif -o semgrep.sarif .
  artifacts:
    reports:
      sast: semgrep.sarif
  allow_failure: true

dependency-scan:
  stage: security
  image: python:3.12-slim
  script:
    - pip install safety pip-audit
    - cd backend && pip-audit -r requirements.txt
    - cd ../frontend && npx audit-ci --moderate
  allow_failure: true

# === BUILD ===
build:frontend:
  stage: build
  image: node:20-alpine
  script:
    - cd frontend && npm ci && npm run build
  artifacts:
    paths: [frontend/.next]
    expire_in: 1 hour

# === DEPLOY STAGING ===
deploy:staging:frontend:
  stage: deploy-staging
  image: node:20-alpine
  script:
    - npx vercel --token=$VERCEL_TOKEN --prod=false
  environment:
    name: staging
    url: https://staging.myapp.com
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

deploy:staging:backend:
  stage: deploy-staging
  script:
    - curl -X POST "https://api.render.com/deploy/srv-${RENDER_SERVICE_ID}?key=${RENDER_API_KEY}"
  environment:
    name: staging-api

# === INTEGRATION TESTS ===
integration:
  stage: integration
  image: node:20-alpine
  script:
    - cd frontend && npx playwright install --with-deps
    - npx playwright test --project=staging
  artifacts:
    when: always
    paths: [frontend/test-results]

# === DEPLOY PRODUCTION (manual gate) ===
deploy:prod:frontend:
  stage: deploy-production
  script:
    - npx vercel --token=$VERCEL_TOKEN --prod
  environment:
    name: production
    url: https://myapp.com
  when: manual
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

deploy:prod:backend:
  stage: deploy-production
  script:
    - curl -X POST "https://api.render.com/deploy/srv-${RENDER_PROD_ID}?key=${RENDER_API_KEY}"
  environment:
    name: production-api
  when: manual

skills:
  - ci-cd
  - docker   # For build stages
  - testing  # For test strategy