instruction: Create a GitHub Actions CI/CD pipeline for a microservice with testing, security scanning, and deployment
output: Here's a comprehensive GitHub Actions CI/CD pipeline:
  
  ```yaml
  name: Microservice CI/CD Pipeline
  
  on:
   push:
   branches: [ main, develop ]
   pull_request:
   branches: [ main ]
   release:
   types: [ published ]
  
  env:
   REGISTRY: ghcr.io
   IMAGE_NAME: ${{ github.repository }}
   NODE_VERSION: '18'
  
  jobs:
   test:
   name: Test and Quality Checks
   runs-on: ubuntu-latest
   
   services:
   postgres:
   image: postgres:14
   env:
   POSTGRES_PASSWORD: postgres
   POSTGRES_DB: testdb
   options: >-
   --health-cmd pg_isready
   --health-interval 10s
   --health-timeout 5s
   --health-retries 5
   ports:
   - 5432:5432
   
   redis:
   image: redis:7-alpine
   options: >-
   --health-cmd "redis-cli ping"
   --health-interval 10s
   --health-timeout 5s
   --health-retries 5
   ports:
   - 6379:6379
   
   steps:
   - name: Checkout code
   uses: actions/checkout@v4
   
   - name: Setup Node.js
   uses: actions/setup-node@v4
   with:
   node-version: ${{ env.NODE_VERSION }}
   cache: 'npm'
   
   - name: Install dependencies
   run: npm ci
   
   - name: Run linting
   run: npm run lint
   
   - name: Run type checking
   run: npm run type-check
   
   - name: Run unit tests
   run: npm run test:unit
   env:
   CI: true
   
   - name: Run integration tests
   run: npm run test:integration
   env:
   DATABASE_URL: postgresql://postgres:postgres@localhost:5432/testdb
   REDIS_URL: redis://localhost:6379
   
   - name: Generate coverage report
   run: npm run test:coverage
   
   - name: Upload coverage to Codecov
   uses: codecov/codecov-action@v3
   with:
   file: ./coverage/lcov.info
   flags: unittests
   name: codecov-umbrella
   
   - name: SonarCloud Scan
   uses: SonarSource/sonarcloud-github-action@master
   env:
   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
  
   security:
   name: Security Scanning
   runs-on: ubuntu-latest
   needs: test
   
   steps:
   - name: Checkout code
   uses: actions/checkout@v4
   
   - name: Run Trivy vulnerability scanner
   uses: aquasecurity/trivy-action@master
   with:
   scan-type: 'fs'
   scan-ref: '.'
   format: 'sarif'
   output: 'trivy-results.sarif'
   
   - name: Upload Trivy scan results
   uses: github/codeql-action/upload-sarif@v2
   with:
   sarif_file: 'trivy-results.sarif'
   
   - name: Run Semgrep security scan
   uses: returntocorp/semgrep-action@v1
   with:
   config: >-
   p/security-audit
   p/secrets
   p/owasp-top-ten
   p/javascript
   
   - name: Dependency vulnerability scan
   run: npm audit --audit-level high
  
   build:
   name: Build and Push Container
   runs-on: ubuntu-latest
   needs: [test, security]
   if: github.event_name != 'pull_request'
   
   permissions:
   contents: read
   packages: write
   
   steps:
   - name: Checkout code
   uses: actions/checkout@v4
   
   - name: Set up Docker Buildx
   uses: docker/setup-buildx-action@v3
   
   - name: Log in to Container Registry
   uses: docker/login-action@v3
   with:
   registry: ${{ env.REGISTRY }}
   username: ${{ github.actor }}
   password: ${{ secrets.GITHUB_TOKEN }}
   
   - name: Extract metadata
   id: meta
   uses: docker/metadata-action@v5
   with:
   images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
   tags: |
   type=ref,event=branch
   type=ref,event=pr
   type=sha,prefix={{branch}}-
   type=raw,value=latest,enable={{is_default_branch}}
   
   - name: Build and push Docker image
   uses: docker/build-push-action@v5
   with:
   context: .
   platforms: linux/amd64,linux/arm64
   push: true
   tags: ${{ steps.meta.outputs.tags }}
   labels: ${{ steps.meta.outputs.labels }}
   cache-from: type=gha
   cache-to: type=gha,mode=max
   
   - name: Sign container image
   uses: sigstore/cosign-installer@v3
   
   - name: Sign the published Docker image
   env:
   COSIGN_EXPERIMENTAL: 1
   run: |
   cosign sign --yes ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
  
   deploy-staging:
   name: Deploy to Staging
   runs-on: ubuntu-latest
   needs: build
   if: github.ref == 'refs/heads/develop'
   environment:
   name: staging
   url: https://staging-api.example.com
   
   steps:
   - name: Checkout code
   uses: actions/checkout@v4
   
   - name: Configure kubectl
   uses: azure/k8s-set-context@v3
   with:
   method: kubeconfig
   kubeconfig: ${{ secrets.KUBE_CONFIG_STAGING }}
   
   - name: Deploy to staging
   uses: azure/k8s-deploy@v1
   with:
   manifests: |
   k8s/staging/deployment.yaml
   k8s/staging/service.yaml
   k8s/staging/ingress.yaml
   images: |
   ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:develop
   
   - name: Run smoke tests
   run: |
   npm run test:smoke -- --endpoint=https://staging-api.example.com
  
   deploy-production:
   name: Deploy to Production
   runs-on: ubuntu-latest
   needs: build
   if: github.event_name == 'release'
   environment:
   name: production
   url: https://api.example.com
   
   steps:
   - name: Checkout code
   uses: actions/checkout@v4
   
   - name: Configure kubectl
   uses: azure/k8s-set-context@v3
   with:
   method: kubeconfig
   kubeconfig: ${{ secrets.KUBE_CONFIG_PROD }}
   
   - name: Deploy to production
   uses: azure/k8s-deploy@v1
   with:
   manifests: |
   k8s/production/deployment.yaml
   k8s/production/service.yaml
   k8s/production/ingress.yaml
   k8s/production/hpa.yaml
   images: |
   ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.event.release.tag_name }}
   
   - name: Run production health check
   run: |
   curl -f https://api.example.com/health || exit 1
   
   - name: Notify deployment
   uses: 8398a7/action-slack@v3
   with:
   status: ${{ job.status }}
   channel: '#deployments'
   text: 'Production deployment completed: ${{ github.event.release.tag_name }}'
   env:
   SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }}
  ```
  
  This pipeline includes:
  - Multi-stage testing with services
  - Security scanning with Trivy and Semgrep
  - Multi-platform container builds
  - Container signing with Cosign
  - Environment-specific deployments
  - Smoke testing and health checks
  - Slack notifications
  
  ## Error Handling and Troubleshooting
  
  ### Common Issues and Solutions
  
  **Issue 1: Container startup failures**
  ```bash
  # Check container logs
  docker logs <container_id>
  
  # Debug with interactive shell
  docker run -it --entrypoint /bin/sh <image_name>
  ```
  
  **Issue 2: Resource constraints**
  ```bash
  # Check resource usage
  kubectl top pods
  kubectl describe pod <pod_name>
  
  # Scale resources if needed
  kubectl patch deployment <deployment_name> -p '{{"spec":{{"template":{{"spec":{{"containers":[{{"name":"<container_name>","resources":{{"requests":{{"memory":"256Mi","cpu":"200m"}},"limits":{{"memory":"512Mi","cpu":"400m"}}}}}}]}}}}}}}'
  ```
  
  **Issue 3: Network connectivity**
  ```bash
  # Test service connectivity
  kubectl exec -it <pod_name> -- wget -qO- <service_name>:<port>/health
  
  # Check service endpoints
  kubectl get endpoints <service_name>
  ```
  
  ### Monitoring and Alerts
  
  Set up proper monitoring to catch issues early:
  
  ```yaml
  # Example alert rule
  groups:
  - name: application.rules
    rules:
    - alert: HighErrorRate
      expr: rate(http_requests_total{{status=~"5.."}}}[5m]) > 0.1
      for: 5m
      annotations:
        summary: "High error rate detected"
        description: "Error rate is above 10% for 5 minutes"
  ```