CI/CD PIPELINES

Pipeline Config Files

Minimal Pipeline — Side by Side

name: CI
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm install
      - run: npm test

stages:
  - build
  - test

build:
  stage: build
  script:
    - npm install

test:
  stage: test
  script:
    - npm test

pipeline {
  agent any
  stages {
    stage('Build') {
      steps {
        sh 'npm install'
      }
    }
    stage('Test') {
      steps {
        sh 'npm test'
      }
    }
  }
}

Pipeline Anatomy

CI vs CD vs CD

Pipeline Triggers

Workflow Structure

name: Build & Deploy
on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'          # Every Monday 6am
  workflow_dispatch:               # Manual trigger
    inputs:
      environment:
        description: 'Deploy target'
        required: true
        default: 'staging'
        type: choice
        options: [staging, production]

permissions:
  contents: read
  packages: write

env:
  NODE_VERSION: '20'
  REGISTRY: ghcr.io

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - run: npm ci
      - run: npm run lint

  test:
    needs: lint
    runs-on: ubuntu-latest
    strategy:
      matrix:
        node-version: [18, 20, 22]
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node-version }}
          cache: 'npm'
      - run: npm ci
      - run: npm test -- --coverage
      - uses: actions/upload-artifact@v4
        with:
          name: coverage-${{ matrix.node-version }}
          path: coverage/

  deploy:
    needs: test
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      - run: echo "Deploying to production"

Key Expressions & Contexts

Reusable Workflows

# .github/workflows/release.yml
jobs:
  call-build:
    uses: ./.github/workflows/build.yml
    with:
      environment: production
    secrets: inherit

  call-deploy:
    needs: call-build
    uses: org/shared-workflows/.github/workflows/deploy.yml@main
    with:
      target: aws
    secrets:
      AWS_ACCESS_KEY: ${{ secrets.AWS_ACCESS_KEY }}

# .github/workflows/build.yml
on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
    secrets:
      AWS_ACCESS_KEY:
        required: false

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: echo "Building for ${{ inputs.environment }}"

Essential Marketplace Actions

Full Pipeline Example

variables:
  NODE_VERSION: "20"
  DOCKER_HOST: tcp://docker:2376

stages:
  - install
  - test
  - build
  - deploy

default:
  image: node:${NODE_VERSION}-alpine
  cache:
    key: ${CI_COMMIT_REF_SLUG}
    paths:
      - node_modules/
      - .npm/

install:
  stage: install
  script:
    - npm ci --cache .npm --prefer-offline
  artifacts:
    paths:
      - node_modules/
    expire_in: 1 hour

lint:
  stage: test
  needs: [install]
  script:
    - npm run lint

unit-tests:
  stage: test
  needs: [install]
  script:
    - npm test -- --coverage
  coverage: '/Lines\s*:\s*(\d+\.?\d*)%/'
  artifacts:
    reports:
      coverage_report:
        coverage_format: cobertura
        path: coverage/cobertura-coverage.xml
      junit: junit.xml

build:
  stage: build
  needs: [lint, unit-tests]
  script:
    - npm run build
  artifacts:
    paths:
      - dist/
    expire_in: 1 week

deploy-staging:
  stage: deploy
  needs: [build]
  environment:
    name: staging
    url: https://staging.example.com
  script:
    - echo "Deploy to staging"
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

deploy-production:
  stage: deploy
  needs: [build]
  environment:
    name: production
    url: https://example.com
  script:
    - echo "Deploy to production"
  rules:
    - if: $CI_COMMIT_TAG
  when: manual

Rules & Conditions

# Run only on main branch
rules:
  - if: $CI_COMMIT_BRANCH == "main"

# Run on merge requests only
rules:
  - if: $CI_PIPELINE_SOURCE == "merge_request_event"

# Run when files change
rules:
  - changes:
      - src/**/*
      - package.json

# Never run on scheduled pipelines
rules:
  - if: $CI_PIPELINE_SOURCE == "schedule"
    when: never
  - when: on_success

# Manual with optional auto
rules:
  - if: $CI_COMMIT_BRANCH == "main"
    when: manual
    allow_failure: true

Include & Extend

# Include templates from other files/repos
include:
  - local: '/.gitlab/ci/test.yml'
  - project: 'devops/templates'
    ref: main
    file: '/docker-build.yml'
  - template: Security/SAST.gitlab-ci.yml

# Reusable job templates
.node-base:
  image: node:20-alpine
  before_script:
    - npm ci

test:
  extends: .node-base
  script:
    - npm test

GitLab-Specific Features

Declarative Pipeline

pipeline {
    agent {
        docker {
            image 'node:20-alpine'
            args '-v $HOME/.npm:/root/.npm'
        }
    }

    environment {
        CI = 'true'
        REGISTRY = credentials('docker-registry')
    }

    options {
        timeout(time: 30, unit: 'MINUTES')
        disableConcurrentBuilds()
        buildDiscarder(logRotator(numToKeepStr: '10'))
    }

    stages {
        stage('Install') {
            steps {
                sh 'npm ci'
            }
        }

        stage('Parallel Checks') {
            parallel {
                stage('Lint') {
                    steps { sh 'npm run lint' }
                }
                stage('Unit Tests') {
                    steps {
                        sh 'npm test -- --ci --reporters=jest-junit'
                    }
                    post {
                        always {
                            junit 'junit.xml'
                        }
                    }
                }
                stage('Security Scan') {
                    steps { sh 'npm audit --audit-level=high' }
                }
            }
        }

        stage('Build') {
            steps {
                sh 'npm run build'
                archiveArtifacts artifacts: 'dist/**', fingerprint: true
            }
        }

        stage('Deploy') {
            when {
                branch 'main'
            }
            input {
                message 'Deploy to production?'
                ok 'Yes, deploy'
            }
            steps {
                sh './scripts/deploy.sh'
            }
        }
    }

    post {
        success { echo 'Pipeline succeeded!' }
        failure {
            mail to: 'team@example.com',
                 subject: "FAILED: ${env.JOB_NAME} #${env.BUILD_NUMBER}",
                 body: "Check: ${env.BUILD_URL}"
        }
        always { cleanWs() }
    }
}

Scripted vs Declarative

Shared Libraries

// vars/buildPipeline.groovy (in shared library repo)
def call(Map config = [:]) {
    pipeline {
        agent any
        stages {
            stage('Build') {
                steps {
                    sh "npm ci"
                    sh "npm run build"
                }
            }
            stage('Test') {
                steps {
                    sh "npm test"
                }
            }
            stage('Deploy') {
                when { branch config.get('deployBranch', 'main') }
                steps {
                    sh "./deploy.sh ${config.environment}"
                }
            }
        }
    }
}

// Jenkinsfile (consuming project)
@Library('my-shared-lib') _
buildPipeline(environment: 'production', deployBranch: 'main')

Dependency Caching

- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: npm-${{ hashFiles('**/package-lock.json') }}
    restore-keys: npm-

# Or built-in with setup-node:
- uses: actions/setup-node@v4
  with:
    node-version: 20
    cache: 'npm'

cache:
  key:
    files:
      - package-lock.json
  paths:
    - node_modules/
    - .npm/
  policy: pull-push    # pull, push, or pull-push

Matrix Builds

jobs:
  test:
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        node: [18, 20, 22]
        exclude:
          - os: macos-latest
            node: 18
        include:
          - os: ubuntu-latest
            node: 22
            experimental: true
    runs-on: ${{ matrix.os }}
    continue-on-error: ${{ matrix.experimental || false }}
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ matrix.node }}
      - run: npm ci && npm test

Fan-Out / Fan-In

# Fan-out: parallel jobs, then fan-in to deploy
jobs:
  lint:
    runs-on: ubuntu-latest
    steps: [...]

  test-unit:
    runs-on: ubuntu-latest
    steps: [...]

  test-integration:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_PASSWORD: test
    steps: [...]

  test-e2e:
    runs-on: ubuntu-latest
    steps: [...]

  # Fan-in: wait for all test jobs
  deploy:
    needs: [lint, test-unit, test-integration, test-e2e]
    runs-on: ubuntu-latest
    steps: [...]

Monorepo — Path-Based Triggers

# Only run when specific package changes
on:
  push:
    paths:
      - 'packages/api/**'
      - 'packages/shared/**'

# Or use dorny/paths-filter for conditional jobs
jobs:
  changes:
    runs-on: ubuntu-latest
    outputs:
      api: ${{ steps.filter.outputs.api }}
      web: ${{ steps.filter.outputs.web }}
    steps:
      - uses: actions/checkout@v4
      - uses: dorny/paths-filter@v3
        id: filter
        with:
          filters: |
            api:
              - 'packages/api/**'
            web:
              - 'packages/web/**'

  build-api:
    needs: changes
    if: needs.changes.outputs.api == 'true'
    runs-on: ubuntu-latest
    steps: [...]

  build-web:
    needs: changes
    if: needs.changes.outputs.web == 'true'
    runs-on: ubuntu-latest
    steps: [...]

Concurrency Control

# Cancel in-progress runs for same branch
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

# For deploy jobs, wait instead of cancelling
concurrency:
  group: deploy-production
  cancel-in-progress: false

Build & Push Image

jobs:
  docker:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
    steps:
      - uses: actions/checkout@v4

      - uses: docker/setup-buildx-action@v3

      - uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/metadata-action@v5
        id: meta
        with:
          images: ghcr.io/${{ github.repository }}
          tags: |
            type=sha
            type=ref,event=branch
            type=semver,pattern={{version}}

      - uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          labels: ${{ steps.meta.outputs.labels }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

Multi-Stage Dockerfile for CI

# Stage 1: Dependencies
FROM node:20-alpine AS deps
WORKDIR /app
COPY package*.json ./
RUN npm ci --production=false

# Stage 2: Build
FROM deps AS build
COPY . .
RUN npm run build
RUN npm prune --production

# Stage 3: Test (used in CI only)
FROM build AS test
RUN npm test

# Stage 4: Production image
FROM node:20-alpine AS production
WORKDIR /app
COPY --from=build /app/dist ./dist
COPY --from=build /app/node_modules ./node_modules
COPY --from=build /app/package.json .
USER node
EXPOSE 3000
CMD ["node", "dist/index.js"]

Docker Compose for Integration Tests

jobs:
  integration:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Start services
        run: docker compose -f docker-compose.test.yml up -d
      - name: Wait for healthy
        run: |
          timeout 60 bash -c 'until docker compose -f docker-compose.test.yml ps | grep -q healthy; do sleep 2; done'
      - name: Run tests
        run: docker compose -f docker-compose.test.yml exec -T app npm run test:integration
      - name: Teardown
        if: always()
        run: docker compose -f docker-compose.test.yml down -v

The Test Pyramid in CI

Parallel Test Splitting

# Split tests across N parallel runners
jobs:
  test:
    strategy:
      matrix:
        shard: [1, 2, 3, 4]
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci
      - name: Run test shard
        run: |
          # Split test files evenly across shards
          FILES=$(find src -name '*.test.ts' | sort | awk "NR % 4 == ${{ matrix.shard }} - 1")
          npx jest $FILES --ci

test:
  stage: test
  parallel: 4
  script:
    - FILES=$(find src -name '*.test.ts' | sort | awk "NR % $CI_NODE_TOTAL == $CI_NODE_INDEX")
    - npx jest $FILES --ci

Coverage Gates

- name: Check coverage threshold
  run: |
    COVERAGE=$(npx jest --coverage --coverageReporters=json-summary \
      | jq '.total.lines.pct')
    echo "Coverage: ${COVERAGE}%"
    if (( $(echo "$COVERAGE < 80" | bc -l) )); then
      echo "::error::Coverage ${COVERAGE}% is below 80% threshold"
      exit 1
    fi

Service Containers for Tests

jobs:
  integration:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_USER: test
          POSTGRES_PASSWORD: test
          POSTGRES_DB: testdb
        ports: ['5432:5432']
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
      redis:
        image: redis:7-alpine
        ports: ['6379:6379']
    env:
      DATABASE_URL: postgresql://test:test@localhost:5432/testdb
      REDIS_URL: redis://localhost:6379
    steps:
      - uses: actions/checkout@v4
      - run: npm ci
      - run: npm run test:integration

Strategy Comparison

Blue-Green Deploy

# Blue-green with AWS ALB target groups
CURRENT=$(aws elbv2 describe-rules ... | jq -r '.TargetGroupArn')
if [[ "$CURRENT" == *"blue"* ]]; then
  DEPLOY_TARGET="green"
else
  DEPLOY_TARGET="blue"
fi

# Deploy to inactive environment
aws ecs update-service --cluster prod \
  --service "api-${DEPLOY_TARGET}" \
  --task-definition "api:${NEW_VERSION}"

# Wait for healthy
aws ecs wait services-stable --cluster prod \
  --services "api-${DEPLOY_TARGET}"

# Run smoke tests against new env
curl -f "https://${DEPLOY_TARGET}.internal/health"

# Switch traffic
aws elbv2 modify-rule --rule-arn $RULE_ARN \
  --actions Type=forward,TargetGroupArn=$NEW_TG_ARN

GitOps with ArgoCD

# CI pipeline updates manifests, ArgoCD syncs
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          repository: org/k8s-manifests
          token: ${{ secrets.DEPLOY_TOKEN }}

      - name: Update image tag
        run: |
          cd apps/api/overlays/production
          kustomize edit set image \
            api=ghcr.io/org/api:${{ github.sha }}

      - name: Commit & push
        run: |
          git config user.name "ci-bot"
          git config user.email "ci@example.com"
          git add .
          git commit -m "deploy: api ${{ github.sha }}"
          git push

Canary with Kubernetes

# Canary: route 10% of traffic to new version
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: api
spec:
  hosts: [api.example.com]
  http:
    - route:
        - destination:
            host: api
            subset: stable
          weight: 90
        - destination:
            host: api
            subset: canary
          weight: 10

Secret Management

OIDC with AWS

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::123456789:role/github-deploy
          aws-region: us-east-1
          # No access keys needed! Uses OIDC token

      - run: aws s3 sync dist/ s3://my-bucket/

Supply Chain Security

Security Scanning Pipeline

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Dependency audit
        run: npm audit --audit-level=high

      - name: Secret detection
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Container scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'ghcr.io/org/app:${{ github.sha }}'
          format: 'sarif'
          output: 'trivy-results.sarif'
          severity: 'CRITICAL,HIGH'

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

Speed Optimization Checklist

Measuring Pipeline Performance

# Add timing to each step
- name: Install dependencies
  run: |
    START=$(date +%s)
    npm ci
    END=$(date +%s)
    echo "::notice::Install took $((END-START))s"

# GitHub provides built-in workflow run analytics
# Settings > Actions > General > view usage

# GitLab: CI/CD > Pipelines > Analytics
# Shows pipeline duration trends over time

Cost Optimization

Common Failures & Fixes

Debugging Techniques

- uses: mxschmitt/action-tmate@v3
  if: failure()

Retry Strategies

# Retry flaky steps
- name: Run flaky integration tests
  uses: nick-fields/retry@v3
  with:
    max_attempts: 3
    timeout_minutes: 10
    command: npm run test:integration

# Manual retry in GitLab
# Click "Retry" on failed job in pipeline view
# Or use API:
# curl --request POST "https://gitlab.com/api/v4/projects/:id/pipelines/:id/retry"