My notes are not so fancy but all items come from a real life incident.

These are the zero-coverage tests I force on my clients: syntax check + coding style + static analysis. (they develop their code, I run it)

Here is the note:

---

Continuous integration and Continuous delivery

How to design and implement CI and CD.

CI

• Run in a premade container or install packages
• Display environment information
• Set access credentials
• Cache OS and programming language library packages
• Check package management configuration (validate & normalize)
• Check outdated packages and known security vulnerabilities
• Build code
• Configure application
• Lint source code
• Lint template files
• Check coding style
• Do static analysis
• Run tests
• Check route methods
• Custom checks and warnings
• Measure code coverage
• Start CD by SSH-ing to own server (restrict,command in authorized_keys and DenyUsers in sshd.conf)
• Wipe sensitive data

CD

• Possible constrains:
  • successful tests
  • do not run on PR-s
  • our repo
  • specific branch
  • tag in commit message [deploy:prod]
  • deploy head commit only
  • optional manual start (GitLab manual actions)
• Do not run as root user
• Keep deploy configuration in a file
• Log every output to a file, log start and finish to syslog
• Limit execution time of time-consuming steps (timeout)
• Optionally back up project files before starting to deploy
• Create a bot user on the server for git access with SSH key (@CompanyBot)
• List changes in current project files
• Check for maintenance mode test -f storage/framework/down , Turn on maintenance mode covering static resource, page, AJAX and API requests
• Clear caches (configuration, routes, application, template etc.)
• Disable cron jobs and background workers after clearing caches (email piped to a program)
• Identify git repository and branch
• Checkout by commit hash (not by branch HEAD)
• At least lint the source code
• Don't deploy testing packages
• Enable production optimizations in package manager
• Build code
• Run database migrations
• Turn off maintenance mode
• Populate caches (application, OPcache, wp rewrite flush)
• Run at least 1 basic functional or unit test (e.g. log in or display dashboard)
• Check HTML output
• Special sudo configuration for reloading PHP-FPM or Cachetool
• Alert on failure
• "Was down for X seconds"
• Send email, Slack, Trello or Google Hangouts notification

Coding style / Coding standard

• Tool: phive install phpcs # squizlabs/php_codesniffer
• Tool: dealerdirect/phpcodesniffer-composer-installer

• commenting rules
• wp-coding-standards/wpcs
• automattic/phpcs-neutron-standard # automattic/phpcs-neutron-ruleset
• slevomat/coding-standard
• object-calisthenics/phpcs-calisthenics-rules
• consistence/coding-standard

Static analysis

• Tool: phpstan/phpstan # phpstan/phpstan-shim # phive install phpstan

• phpstan/phpstan-deprecation-rules
• phpstan/phpstan-strict-rules
• szepeviktor/phpstan-wordpress

( live version: https://github.com/szepeviktor/debian-server-tools/blob/master/webserver/Continuous-integration-Continuous-delivery.md )