CI/CD va DevOps

# .github/workflows/quvur.yml
name: CI/CD quvuri

on:
  push:
    branches: [main]
  pull_request:

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  sifat:
    name: Kod sifati
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: shivammathur/setup-php@v2
        with:
          php-version: '8.3'
          coverage: none

      - name: Composer keshi
        uses: actions/cache@v4
        with:
          path: vendor
          key: ${{ runner.os }}-composer-${{ hashFiles('composer.lock') }}

      - run: composer install --prefer-dist --no-progress

      - name: Kod uslubi
        run: vendor/bin/php-cs-fixer fix --dry-run --diff

      - name: Statik tahlil
        run: vendor/bin/phpstan analyse --error-format=github

      - name: Xavfsizlik auditi
        run: composer audit

  testlar:
    name: Testlar (PHP ${{ matrix.php }})
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        php: ['8.2', '8.3']

    services:
      mysql:
        image: mysql:8.0
        env:
          MYSQL_ROOT_PASSWORD: sinov
          MYSQL_DATABASE: sinov_baza
        ports: ['3306:3306']
        options: >-
          --health-cmd="mysqladmin ping"
          --health-interval=10s
          --health-retries=5

    steps:
      - uses: actions/checkout@v4

      - uses: shivammathur/setup-php@v2
        with:
          php-version: ${{ matrix.php }}
          coverage: xdebug

      - run: composer install --prefer-dist --no-progress

      - name: Migratsiyalar
        run: php tools/migrate.php
        env:
          DB_HOST: 127.0.0.1
          DB_DATABASE: sinov_baza
          DB_PASSWORD: sinov

      - name: Testlar
        run: vendor/bin/phpunit --coverage-clover=coverage.xml

      - name: Qoplama hisoboti
        uses: codecov/codecov-action@v4
        with:
          files: coverage.xml

  deploy:
    name: Ishlab chiqarishga chiqarish
    needs: [sifat, testlar]
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: production

    steps:
      - uses: actions/checkout@v4

      - name: Serverga chiqarish
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.SERVER_HOST }}
          username: ${{ secrets.SERVER_USER }}
          key: ${{ secrets.SSH_KALIT }}
          script: |
            cd /var/www/dokon
            ./deploy.sh ${{ github.sha }}

#!/bin/bash
# deploy.sh - atomik deploy
set -euo pipefail

RELIZ=$1
ILDIZ=/var/www/dokon
RELIZLAR=$ILDIZ/relizlar
YANGI=$RELIZLAR/$RELIZ

echo "==> Reliz tayyorlanmoqda: $RELIZ"
mkdir -p "$YANGI"
git archive "$RELIZ" | tar -x -C "$YANGI"

echo "==> Bog'liqliklar"
cd "$YANGI"
composer install --no-dev --optimize-autoloader --no-interaction

echo "==> Umumiy kataloglar"
ln -sfn "$ILDIZ/umumiy/.env" "$YANGI/.env"
ln -sfn "$ILDIZ/umumiy/yuklamalar" "$YANGI/public/yuklamalar"
rm -rf "$YANGI/storage" && ln -sfn "$ILDIZ/umumiy/storage" "$YANGI/storage"

echo "==> Migratsiyalar"
php "$YANGI/tools/migrate.php"

echo "==> Salomatlik tekshiruvi"
php "$YANGI/tools/salomatlik.php" || { echo "Tekshiruv o'tmadi"; exit 1; }

echo "==> Almashtirish"
ln -sfn "$YANGI" "$ILDIZ/joriy"
sudo systemctl reload php8.3-fpm

echo "==> Eski relizlarni tozalash (oxirgi 5 tasi qoladi)"
cd "$RELIZLAR" && ls -1t | tail -n +6 | xargs -r rm -rf

echo "==> Tayyor: $RELIZ"

final class FunksiyaKalitlari
{
    public function __construct(
        private KeshInterfeysi $kesh,
        private SozlamaRepozitoriyi $repozitoriy,
    ) {}

    public function yoqilganmi(string $nom, ?int $foydalanuvchiId = null): bool
    {
        $kalit = $this->kesh->eslab("kalit:{$nom}", 60,
            fn () => $this->repozitoriy->oling($nom));

        if ($kalit === null || !$kalit->faol) {
            return false;
        }

        if ($kalit->foiz === 100) {
            return true;
        }

        if ($foydalanuvchiId === null) {
            return false;
        }

        // Bir foydalanuvchi har doim bir xil guruhga tushsin
        $xesh = crc32("{$nom}:{$foydalanuvchiId}") % 100;

        return $xesh < $kalit->foiz;
    }
}

if ($kalitlar->yoqilganmi('yangi_savat', $foydalanuvchi->id)) {
    return $this->yangiSavat->korsating();
}

return $this->eskiSavat->korsating();

# .env.staging
APP_MUHIT=staging
EMAIL_YUBORILSINMI=false
SMS_YUBORILSINMI=false
TOLOV_REJIMI=sinov

# infratuzilma/asosiy.tf
resource "digitalocean_droplet" "veb" {
  count  = 2
  name   = "dokon-veb-${count.index + 1}"
  region = "fra1"
  size   = "s-2vcpu-4gb"
  image  = "ubuntu-24-04-x64"

  ssh_keys = [var.ssh_kalit_id]

  tags = ["dokon", "veb", "production"]
}

resource "digitalocean_database_cluster" "mysql" {
  name       = "dokon-mysql"
  engine     = "mysql"
  version    = "8"
  size       = "db-s-2vcpu-4gb"
  region     = "fra1"
  node_count = 2
}

resource "digitalocean_loadbalancer" "asosiy" {
  name   = "dokon-balanser"
  region = "fra1"

  forwarding_rule {
    entry_port     = 443
    entry_protocol = "https"
    target_port     = 80
    target_protocol = "http"
    certificate_name = "dokon-uz"
  }

  healthcheck {
    port     = 80
    protocol = "http"
    path     = "/salomatlik"
  }

  droplet_ids = digitalocean_droplet.veb[*].id
}

terraform plan     # nima o'zgarishini ko'rsatadi
terraform apply    # qo'llaydi

# Ko'p bosqichli qurish
FROM composer:2 AS bogliqliklar
WORKDIR /ilova
COPY composer.json composer.lock ./
RUN composer install --no-dev --no-scripts --optimize-autoloader

FROM php:8.3-fpm-alpine
RUN apk add --no-cache libzip-dev \
    && docker-php-ext-install pdo_mysql opcache zip

COPY --from=bogliqliklar /ilova/vendor /var/www/vendor
COPY . /var/www

WORKDIR /var/www

RUN addgroup -g 1000 ilova && adduser -u 1000 -G ilova -D ilova \
    && chown -R ilova:ilova /var/www/storage
USER ilova

HEALTHCHECK --interval=30s --timeout=3s --start-period=10s \
  CMD php -r "exit(@file_get_contents('http://localhost:9000/salomatlik') ? 0 : 1);"

EXPOSE 9000
CMD ["php-fpm"]

# docker-compose.yml
services:
  ilova:
    build: .
    depends_on:
      mysql:
        condition: service_healthy
    environment:
      DB_HOST: mysql
    volumes:
      - ./storage:/var/www/storage

  mysql:
    image: mysql:8.0
    environment:
      MYSQL_ROOT_PASSWORD: ${DB_PAROL}
      MYSQL_DATABASE: dokon
    volumes:
      - mysql_malumot:/var/lib/mysql
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
      interval: 10s
      retries: 5

  nginx:
    image: nginx:alpine
    ports: ["80:80"]
    volumes:
      - ./nginx.conf:/etc/nginx/conf.d/default.conf:ro
    depends_on: [ilova]

volumes:
  mysql_malumot:

// Tuzilmali jurnal
$this->jurnal->info('buyurtma_yaratildi', [
    'buyurtma_id' => $buyurtma->id,
    'mijoz_id'    => $buyurtma->mijozId,
    'summa'       => $buyurtma->jami()->tiyin,
    'elementlar'  => count($buyurtma->elementlar()),
    'davomiylik_ms' => $davomiylik,
    'sorov_id'    => $sorovId,
]);

{
  "vaqt": "2026-08-15T14:22:31.482+05:00",
  "daraja": "info",
  "hodisa": "buyurtma_yaratildi",
  "buyurtma_id": 1042,
  "mijoz_id": 7,
  "summa": 75000000,
  "elementlar": 3,
  "davomiylik_ms": 187,
  "sorov_id": "req_8f3a1d0e"
}

# prometheus/qoidalar.yml
groups:
  - name: dokon
    rules:
      - alert: YuqoriXatoDarajasi
        expr: |
          sum(rate(http_sorovlar_total{kod=~"5.."}[5m]))
          / sum(rate(http_sorovlar_total[5m])) > 0.05
        for: 5m
        labels:
          jiddiylik: kritik
        annotations:
          xulosa: "Xato darajasi 5% dan yuqori"
          tavsif: "Oxirgi 5 daqiqada {{ $value | humanizePercentage }}"

      - alert: SekinJavob
        expr: |
          histogram_quantile(0.95,
            rate(http_davomiylik_seconds_bucket[5m])) > 2
        for: 10m
        labels:
          jiddiylik: ogohlantirish
        annotations:
          xulosa: "95-protsentil javob vaqti 2 soniyadan yuqori"

      - alert: BazaUlanishlariTolgan
        expr: mysql_ulanishlar_faol / mysql_ulanishlar_maks > 0.8
        for: 5m
        labels:
          jiddiylik: ogohlantirish

// public/salomatlik.php
$tekshiruvlar = [
    'baza' => function (): bool {
        try {
            return (bool) app(PDO::class)->query('SELECT 1')->fetchColumn();
        } catch (Throwable) {
            return false;
        }
    },
    'kesh' => function (): bool {
        try {
            app(KeshInterfeysi::class)->saqlang('salomatlik', '1', 10);
            return app(KeshInterfeysi::class)->oling('salomatlik') === '1';
        } catch (Throwable) {
            return false;
        }
    },
    'disk' => fn (): bool => disk_free_space('/') > 1024 * 1024 * 500,
];

$natijalar = [];
$sogmi = true;

foreach ($tekshiruvlar as $nom => $tekshiruv) {
    $natija = $tekshiruv();
    $natijalar[$nom] = $natija ? 'ok' : 'xato';
    $sogmi = $sogmi && $natija;
}

http_response_code($sogmi ? 200 : 503);
header('Content-Type: application/json');

echo json_encode([
    'holat'     => $sogmi ? 'sog' : 'nosoz',
    'versiya'   => getenv('APP_VERSIYA'),
    'tekshiruvlar' => $natijalar,
], JSON_UNESCAPED_UNICODE);