CI/CD Pipelines

CI/CD (Continuous Integration and Continuous Delivery/Deployment) automates the path from code commit to production, enabling teams to ship high-quality software multiple times per day. Continuous Integration merges developer branches frequently (ideally daily), running automated build and test suites on every push. Continuous Delivery ensures every passing build is releasable; Continuous Deployment automatically releases every passing build without human gates. Industry leaders like Netflix deploy thousands of times per day using sophisticated pipeline orchestration on Jenkins, GitHub Actions, or GitLab CI.

Key Points

• Pipeline stages: source trigger → build/compile → unit test → integration test → security scan (SAST/DAST) → artifact publish → deploy → smoke test.
• Fail fast: order stages from fastest to slowest — unit tests before integration tests, static analysis before dynamic scanning.
• GitHub Actions uses YAML-defined workflows triggered by push, PR, schedule, or manual dispatch; runners are ephemeral VMs or containers.
• GitLab CI/CD defines pipelines in .gitlab-ci.yml with stages, jobs, and DAG dependencies; built-in container registry and environments.
• Artifact immutability: the same container image or binary promoted through staging to production — never rebuild per environment.
• Security scanning: embed SAST (Semgrep, CodeQL), dependency scanning (Dependabot, Snyk), and container scanning (Trivy) in CI.
• Branch protection rules enforce CI passing before merge — prevents broken builds from reaching main.
• Cache dependencies (node_modules, Maven .m2, pip) between runs to cut build times from minutes to seconds.

GitHub Actions workflow: build, test, security scan, then canary deploy on main branch merge

name: CI/CD Pipeline
on: [push, pull_request]
jobs:
  build-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Build
        run: npm ci && npm run build
      - name: Test
        run: npm test -- --coverage
      - name: Security Scan
        uses: aquasecurity/trivy-action@master
  deploy:
    needs: build-test
    if: github.ref == 'refs/heads/main'
    steps:
      - name: Deploy to Production
        run: ./deploy.sh canary