Set up CI/CD pipeline

[sky1502]

Objective

Add a production-ready CI/CD pipeline for WatchIt to automatically validate code changes, prevent broken builds from merging, and deploy approved changes reliably.

Scope

Continuous Integration

Run on every pull request and push to relevant branches:

• Install dependencies for the frontend, backend, and extension
• Run linting, formatting checks, and TypeScript validation
• Run unit and integration tests where available
• Build the Next.js dashboard and FastAPI backend to catch build-time failures
• Validate environment variable configuration without exposing secrets
• Upload relevant test and build logs as GitHub Actions artifacts on failure

Continuous Deployment

Set up branch-based deployment:

• Deploy preview environments for pull requests where supported
• Automatically deploy staging from dev
• Automatically deploy production from main after all CI checks pass
• Use GitHub Actions secrets for deployment credentials and runtime environment variables
• Add deployment status checks back to the related pull request or commit

Recommended Workflow Files

• .github/workflows/ci.yml: lint, typecheck, test, and build
• .github/workflows/deploy-staging.yml: deploy on merge to dev
• .github/workflows/deploy-production.yml: deploy on merge to main

Acceptance Criteria

• Pull requests cannot be merged when linting, type checks, tests, or builds fail.
• Every CI run clearly identifies the failed service and step.
• Merges to dev trigger a staging deployment.
• Merges to main trigger a production deployment only after successful checks.
• Secrets are stored only in GitHub Actions or the deployment provider, never committed to the repository.
• Deployment outcomes are visible in GitHub Actions and linked to the related commit or pull request.
• main is protected and requires successful CI checks before merge.

Documentation

Document:

• Required GitHub repository secrets
• Deployment branch strategy
• Rollback process
• Local commands for reproducing CI checks
• How to manually trigger deployments when needed