CI/CD Pipelines

What is CI/CD?

CI (Continuous Integration) — Developers merge code frequently. Each merge triggers automated builds and tests.

CD (Continuous Delivery) — Every passing build is automatically deployed to a staging environment, ready to release to production with one click.

CD (Continuous Deployment) — Goes one step further: every passing build is automatically deployed to production without human intervention.

Code Push → CI (build + test) → CD (deploy to staging) → [approve] → production

Why CI/CD?

Pipeline Stages

A typical pipeline has these stages in order:

Source → Build → Test → Security Scan → Artifact → Deploy Staging → Smoke Test → Deploy Prod

1. Source

Triggered by a git push or Pull Request. The pipeline checks out the code.

2. Build

Compile the app, install dependencies, create a binary or Docker image.

npm install
npm run build
docker build -t myapp:latest .

3. Test

Run automated tests. If any fail, the pipeline stops.

npm test              # unit tests
npm run test:e2e      # end-to-end tests

4. Security Scan (SAST/DAST)

Scan code and dependencies for known vulnerabilities.

npm audit
trivy image myapp:latest

5. Artifact

Push the build artifact (Docker image, JAR, ZIP) to a registry.

docker push myregistry/myapp:latest

6. Deploy to Staging

Deploy the artifact to a staging/QA environment.

7. Smoke Test

Quick sanity checks against staging to confirm the app is alive.

8. Deploy to Production

After approval (or automatically), deploy to production.

GitHub Actions Example

.github/workflows/ci.yml:

name: CI/CD Pipeline

on:
  push:
    branches: [main]

jobs:
  build-and-test:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - name: Install dependencies
        run: npm ci

      - name: Run tests
        run: npm test

      - name: Build
        run: npm run build

  deploy:
    needs: build-and-test
    runs-on: ubuntu-latest
    if: github.ref == 'refs/heads/main'
    steps:
      - name: Deploy to production
        run: echo "Deploying..."
        # replace with your deploy script

Popular CI/CD Tools

Key Concepts

Artifacts

The output of a build step stored and passed between stages. Examples: Docker image, .jar file, .zip archive.

Environment Variables & Secrets

Never hardcode credentials. Use your CI platform’s secrets manager:

# GitHub Actions
env:
  DB_PASSWORD: ${{ secrets.DB_PASSWORD }}

Caching

Speed up pipelines by caching dependencies:

- uses: actions/cache@v3
  with:
    path: ~/.npm
    key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}

Rollback Strategy

Always be able to go back. Common approaches:

• Blue/Green — two identical environments, switch traffic between them
• Canary — roll out to 5% of users first, then gradually increase
• Feature flags — deploy code but keep features off until ready

Best Practices

1. Keep pipelines fast — aim for under 10 minutes for CI
2. Fail fast — run quick checks (lint, unit tests) before slow ones (e2e, build)
3. One pipeline per repo — keep pipelines close to the code
4. Never commit secrets — use environment variables and secret managers
5. Version your pipeline configs — they’re code too, review them in PRs
6. Notify on failure — send Slack/email alerts when pipelines break