GitHub Mastery: The Final Project and Assessment

# Create a Node.js project (or use an existing repo)
mkdir github-mastery-capstone && cd github-mastery-capstone
git init
npm init -y
npm install --save-dev typescript jest @types/jest ts-jest

# Create a basic TypeScript project
mkdir src
cat > src/calculator.ts << 'EOF'
export function add(a: number, b: number): number {
  return a + b;
}

export function divide(a: number, b: number): number {
  if (b === 0) throw new Error('Division by zero');
  return a / b;
}
EOF

cat > src/calculator.test.ts << 'EOF'
import { add, divide } from './calculator';

describe('add', () => {
  it('adds two numbers', () => expect(add(2, 3)).toBe(5));
});

describe('divide', () => {
  it('divides two numbers', () => expect(divide(10, 2)).toBe(5));
  it('throws on division by zero', () => expect(() => divide(1, 0)).toThrow());
});
EOF

git add . && git commit -m "feat: initial project setup"
git branch -M main
git remote add origin https://github.com/YOUR_USERNAME/github-mastery-capstone.git
git push -u origin main

Branch name pattern: main

☑ Require a pull request before merging
  ☑ Require approvals: 1
  ☑ Dismiss stale pull request approvals when new commits are pushed

☑ Require status checks to pass before merging
  ☑ Require branches to be up to date before merging
  Search and add: ci / lint, ci / test (ubuntu-latest), ci / test (windows-latest)

☑ Require signed commits
☑ Do not allow bypassing the above settings

# .github/CODEOWNERS
# All changes require review from the platform team
* @YOUR_USERNAME

# Infrastructure changes require an additional review
/.github/workflows/ @YOUR_USERNAME
/infrastructure/ @YOUR_USERNAME

# .github/workflows/ci.yml
name: CI

on:
  pull_request:
    branches: [main]
  push:
    branches: [main]

jobs:
  lint:
    name: ci / lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - run: npm ci
      - run: npx tsc --noEmit          # TypeScript type checking
      - run: npx eslint src/           # Linting

  test:
    name: ci / test
    strategy:
      matrix:
        os: [ubuntu-latest, windows-latest]
        node: ['18', '20']
      fail-fast: false    # Don't cancel other matrix jobs on failure
    runs-on: ${{ matrix.os }}
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
          cache: 'npm'

      - run: npm ci
      - run: npm test -- --coverage

      - name: Upload coverage
        uses: actions/upload-artifact@v4
        if: matrix.os == 'ubuntu-latest' && matrix.node == '20'
        with:
          name: coverage-report
          path: coverage/

  build:
    name: ci / build
    needs: [lint, test]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'
      - run: npm ci && npm run build

      - name: Upload build artifact
        uses: actions/upload-artifact@v4
        with:
          name: dist-${{ github.sha }}
          path: dist/
          retention-days: 7

# .github/dependabot.yml
version: 2
updates:
  - package-ecosystem: npm
    directory: /
    schedule:
      interval: weekly
      day: monday
      time: "09:00"
    open-pull-requests-limit: 5
    labels:
      - dependencies
    commit-message:
      prefix: "chore"

  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
    commit-message:
      prefix: "chore(ci)"

# .github/workflows/codeql.yml
name: CodeQL Security Analysis

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'    # Weekly on Monday at 6am UTC

jobs:
  analyze:
    name: Analyze (${{ matrix.language }})
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read

    strategy:
      matrix:
        language: [javascript-typescript]

    steps:
      - uses: actions/checkout@v4

      - uses: github/codeql-action/init@v3
        with:
          languages: ${{ matrix.language }}
          queries: security-extended    # More thorough than default

      - uses: github/codeql-action/autobuild@v3

      - uses: github/codeql-action/analyze@v3
        with:
          category: /language:${{ matrix.language }}

# Create the OIDC identity provider in AWS
aws iam create-open-id-connect-provider \
  --url https://token.actions.githubusercontent.com \
  --client-id-list sts.amazonaws.com \
  --thumbprint-list 6938fd4d98bab03faadb97b34396831e3780aea1

# Create IAM role for staging deployments
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)

aws iam create-role \
  --role-name github-actions-staging \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::'"$ACCOUNT_ID"':oidc-provider/token.actions.githubusercontent.com"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
        },
        "StringLike": {
          "token.actions.githubusercontent.com:sub": "repo:YOUR_USERNAME/github-mastery-capstone:environment:staging"
        }
      }
    }]
  }'

# .github/workflows/deploy.yml
name: Deploy

on:
  push:
    branches: [main]

jobs:
  deploy-staging:
    name: Deploy to Staging
    runs-on: ubuntu-latest
    environment: staging
    permissions:
      id-token: write
      contents: read
    needs: []    # No dependency — deploys immediately after push to main

    steps:
      - uses: actions/checkout@v4

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
          aws-region: us-east-1

      - name: Deploy to staging
        run: |
          echo "Deploying commit ${{ github.sha }} to staging..."
          # aws s3 sync ./dist s3://your-staging-bucket/
          echo "Deployed successfully"

  deploy-production:
    name: Deploy to Production
    runs-on: ubuntu-latest
    environment: production       # Requires manual approval
    permissions:
      id-token: write
      contents: read
    needs: [deploy-staging]

    steps:
      - uses: actions/checkout@v4

      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ vars.AWS_ROLE_ARN }}
          aws-region: us-east-1

      - name: Deploy to production
        run: |
          echo "Deploying ${{ github.sha }} to production..."
          echo "Deployed successfully"

npm install --save-dev semantic-release @semantic-release/changelog @semantic-release/git

// .releaserc.json
{
  "branches": ["main"],
  "plugins": [
    "@semantic-release/commit-analyzer",
    "@semantic-release/release-notes-generator",
    "@semantic-release/changelog",
    ["@semantic-release/npm", { "npmPublish": false }],
    "@semantic-release/github",
    ["@semantic-release/git", {
      "assets": ["CHANGELOG.md", "package.json"],
      "message": "chore(release): ${nextRelease.version} [skip ci]"
    }]
  ]
}

# .github/workflows/release.yml
name: Release

on:
  push:
    branches: [main]

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      issues: write
      pull-requests: write

    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          persist-credentials: false

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
          cache: 'npm'

      - run: npm ci

      - name: Release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: npx semantic-release

git commit -m "feat: add multiply function"
git commit -m "fix: handle NaN inputs in divide"
git commit -m "feat!: change API to return Result type

BREAKING CHANGE: divide now returns {value, error} instead of throwing"