A five-step AWS pipeline I want before a SyBazar service ships

The minimum CI/CD I use for NestJS and Express services at WaftTech. Copy the steps, then add staging that runs the same migrations as production.

SyBazar, Nepmeds, and Samsung Plaza all go out as tagged images. Cloud work is easy to overbuild. These five steps are what actually prevent 2 a.m. rollbacks.

Step 1: Typecheck and unit tests on every pull request

name: pr
on: pull_request
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci
      - run: npx tsc --noEmit
      - run: npm test

Step 2: Smoke boot the app and hit /health

A green unit suite that never starts HTTP is how you ship a broken NestJS module to AWS.

Step 3: Build a tagged Docker image, never latest

SHA=$(git rev-parse --short HEAD)
docker build -t sybazar-api:$SHA .
docker tag sybazar-api:$SHA sybazar-api:previous || true

Step 4: Run migrations as their own job

Do not migrate inside the web process. Staging must use the same migration path as production — that is where most SyBazar deploy bugs actually live.

Step 5: Keep a one-command rollback to the previous tag

• Store the previous image tag next to the current one.
• Rollback is a deploy of that tag, not a git revert on a running box.
• No secrets in the image. Config comes from the environment.