Align README with CI workflow

Author: darestack

README.md

@@ -1,7 +1,6 @@
 # github-actions-cicd-demo
 
-> A complete CI/CD pipeline demonstrating security scanning, multi-version testing,
-> Docker image publishing to GHCR, and staged deployment — all built with GitHub Actions.
+> Node.js CI/CD lab demonstrating matrix tests, linting, Trivy SARIF upload, Docker Buildx, GHCR publishing, and simulated staged deploys with GitHub Actions.
 
 **Context:** This is the pipeline implementation from [devops-labs Module-3 Mini-Project 9](https://github.com/darestack/devops-labs/tree/main/Module-3/mini-project-09). Full implementation notes live there.
 
@@ -11,11 +10,11 @@
 
 | Stage | What It Does | Key Detail |
 |---|---|---|
-| `test` | Unit tests across multiple Node.js versions | Build matrix: Node 12, 14, 16 with npm dependency caching |
-| `code-quality` | ESLint static analysis | Configured to **fail the build** on lint errors — no `continue-on-error` |
+| `test` | Unit tests across multiple Node.js versions | Build matrix: Node 18 and 20 with npm dependency caching. This job also runs the hard lint gate. |
+| `code-quality` | ESLint SARIF upload | Publishes lint annotations to GitHub Code Scanning. The hard lint gate lives in the `test` job. |
 | `security` | Trivy vulnerability scan | Results uploaded as SARIF to GitHub Code Scanning |
 | `build` | Docker image creation | Pushes to GHCR tagged with both `branch-name` and `commit-SHA` |
-| `deploy` | Staged rollout | Staging deploy → integration + smoke tests → production deploy |
+| `deploy` | Simulated staged rollout | Staging deploy logs -> integration/smoke-test placeholder -> production deploy logs |
 
 ---
 
@@ -24,11 +23,11 @@
 ```
 Push to main / PR opened
   │
-  ├── test (matrix: Node 12, 14, 16)
-  │     └── npm ci (cached) → npm test → coverage report
+  ├── test (matrix: Node 18, 20)
+  │     └── npm ci (cached) → npm run lint → npm test → coverage report
   │
   ├── code-quality
-  │     └── ESLint → fails build on any error
+  │     └── ESLint SARIF → GitHub Code Scanning annotations
   │
   ├── security
   │     └── Trivy filesystem scan → SARIF → GitHub Code Scanning
@@ -37,8 +36,8 @@ Push to main / PR opened
   │     └── docker/setup-buildx → docker/build-push → GHCR
   │
   └── deploy (depends on: build)
-        ├── Staging environment deploy
-        ├── Integration tests + smoke tests
+        ├── Simulated staging deploy
+        ├── Placeholder integration + smoke tests
         └── Production deploy
 ```
 
@@ -48,13 +47,13 @@ Push to main / PR opened
 
 **GHCR image tagging:** Each image is tagged with both `latest` and the commit SHA — enabling rollback to any previous build without relying on the `latest` tag alone.
 
-**ESLint as a hard gate:** Removed `continue-on-error: true` from the lint step. If ESLint finds errors, the entire pipeline stops — no broken code reaches Docker build.
+**ESLint as a hard gate:** The matrix `test` job runs `npm run lint` before tests. The separate `code-quality` job keeps `continue-on-error` for SARIF upload so annotations can still be published for review.
 
 **Trivy SARIF upload:** Required adding `security-events: write` to the job-level permissions block. Without this, the upload fails silently.
 
 **Docker Buildx:** The default GitHub Actions Docker driver does not support cache export. Fixed by adding `docker/setup-buildx-action@v3` before the build step.
 
-**GHCR push permissions:** `GITHUB_TOKEN` requires explicit `packages: write` in the job permissions to create new container packages.
+**GHCR push permissions:** `GITHUB_TOKEN` requires explicit `packages: write` in the build job permissions to create new container packages.
 
 ---
 
@@ -72,6 +71,12 @@ Push to `main` or open a PR to trigger the full pipeline.
 
 ---
 
+## Current Boundary
+
+The staging and production deploy jobs are intentionally simulated in this lab. They show environment flow and dependency ordering, but they do not deploy to a real target yet. To make this a production deployment project, replace the `echo` deployment steps with a real target such as EC2, ECS, Kubernetes, or a PaaS and add deployment logs.
+
+---
+
 ## Stack
 
 `GitHub Actions` · `Docker` · `GHCR` · `Trivy` · `Node.js` · `ESLint`