Refresh EC2 pipeline runtime and rollback

Author: darestack

.eslintrc.js

@@ -1,11 +1,11 @@
 module.exports = {
-  extends: "airbnb-base",
+  extends: 'airbnb-base',
   env: {
     node: true,
     es2022: true,
     jest: true,
   },
   rules: {
-    "no-console": "off",
+    'no-console': 'off',
   },
 };

.github/workflows/ci.yml

@@ -7,18 +7,24 @@ on:
       - development
       - "feature/*"
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 jobs:
   build-and-test:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    strategy:
+      matrix:
+        node-version: ["22.x", "24.x"]
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v4
+      - name: Set up Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v6
         with:
-          node-version: "20"
+          node-version: ${{ matrix.node-version }}
           cache: npm
           cache-dependency-path: package-lock.json
 
@@ -28,15 +34,18 @@ jobs:
       - name: Run tests
         run: npm test
 
+      - name: Run linting
+        run: npm run lint
+
   bump-version:
     needs: build-and-test
     if: github.ref == 'refs/heads/main'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           fetch-depth: "0"
 

.github/workflows/health-check.yml

@@ -9,9 +9,12 @@ concurrency:
   group: health-check
   cancel-in-progress: true
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 jobs:
   health-check:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       issues: write
       contents: read
@@ -57,7 +60,7 @@ jobs:
       - name: Find existing health-check issue
         id: existing_issue
         if: failure() && steps.check.outputs.failed == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const { owner, repo } = context.repo;
@@ -69,7 +72,7 @@ jobs:
 
       - name: Create health-check issue
         if: failure() && steps.check.outputs.failed == 'true' && steps.existing_issue.outputs.number == ''
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const body = [
@@ -88,7 +91,7 @@ jobs:
 
       - name: Update existing health-check issue
         if: failure() && steps.check.outputs.failed == 'true' && steps.existing_issue.outputs.number != ''
-        uses: actions/github-script@v7
+        uses: actions/github-script@v8
         with:
           script: |
             const body = [

.github/workflows/release.yml

@@ -5,12 +5,15 @@ on:
     tags:
       - "v*"
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 jobs:
   deploy:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@v6
 
       - name: Set up deployment environment
         run: |
@@ -39,22 +42,23 @@ jobs:
           # copy tarball to EC2
           scp -o StrictHostKeyChecking=no -i private_key.pem deployment.tar.gz $EC2_USER@$EC2_HOST:/tmp/
 
-          # extract and run deploy.sh on EC2
+          # Extract and run deploy.sh from /tmp so /var/www/app only contains release-managed files.
           ssh -o StrictHostKeyChecking=no -i private_key.pem $EC2_USER@$EC2_HOST "
-            mkdir -p /var/www/app &&
-            tar -xzf /tmp/deployment.tar.gz -C /var/www/app &&
-            chmod +x /var/www/app/scripts/deploy.sh &&
-            /var/www/app/scripts/deploy.sh
+            rm -rf /tmp/ec2-pipeline-deploy &&
+            mkdir -p /tmp/ec2-pipeline-deploy /var/www/app &&
+            tar -xzf /tmp/deployment.tar.gz -C /tmp/ec2-pipeline-deploy &&
+            chmod +x /tmp/ec2-pipeline-deploy/scripts/deploy.sh &&
+            /tmp/ec2-pipeline-deploy/scripts/deploy.sh
           "
 
   create-release:
     needs: deploy
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Create GitHub Release
         uses: softprops/action-gh-release@v2

README.md

@@ -13,7 +13,7 @@
 Push to main / feature branch
   │
   └── ci.yml
-        ├── build-and-test: npm ci → Jest tests → pass/fail gate
+        ├── build-and-test: Node 22/24 matrix → npm ci → Jest tests → ESLint gate
         └── bump-version (main only): patch version bump → git tag v1.x.x
                 │
                 └── release.yml (triggered by tag v*)
@@ -26,7 +26,7 @@ Push to main / feature branch
 | Decision | Implementation | Why |
 |---|---|---|
 | **Low-interruption deploy** | `pm2 reload` + atomic symlink swap (`current -> release-timestamp`) | Keeps deploy behavior predictable and rollback-friendly |
-| **Auto-rollback** | `deploy.sh` keeps previous release; restores on failure | No manual intervention if deploy breaks the app |
+| **Auto-rollback** | `deploy.sh` keeps the previous `current` target until the new release passes health checks | Restores the last known-good symlink if deploy breaks the app |
 | **Automatic versioning** | `bump-version` job creates `v1.x.x` tags on every merge to main | Release history is automatic; no manual tagging |
 | **Health check monitoring** | Scheduled workflow runs hourly and reuses one open health-check issue while an outage is active | Avoids duplicate alert noise and keeps incident state readable |
 | **Separate CI / CD workflows** | `ci.yml` + `release.yml` split by tag trigger | CD only runs on verified, tagged builds — not every push |
@@ -38,7 +38,7 @@ Push to main / feature branch
 ### `ci.yml` — Continuous Integration
 Triggers: push to `main`, `development`, `feature/*` branches + all PRs
 
-1. **`build-and-test`**: `npm ci` → Jest test suite → pass required before merge
+1. **`build-and-test`**: Node 22/24 matrix → `npm ci` → Jest test suite → ESLint gate
 2. **`bump-version`** (main only): increments patch version, pushes `v1.x.x` tag — triggers `release.yml`
 
 ### `release.yml` — Continuous Deployment  
@@ -69,7 +69,9 @@ Also set: **Actions → General → Workflow permissions → Read and write** (a
 
 ## Application Stack
 
-`Node.js 20 LTS` · `Express` · `Jest` · `PM2` · `GitHub Actions` · `AWS EC2`
+`Node.js 22/24` · `Express` · `Jest` · `PM2` · `GitHub Actions` · `AWS EC2`
+
+The EC2 host should run Node.js 22 or 24 so the deployed runtime matches CI.
 
 ---