DevOps6 min read

CI/CD Pipelines

Build reliable CI/CD pipelines that test, lint, build, and deploy code automatically - using GitHub Actions for fast, safe continuous delivery.

CI/CDGitHub ActionsContinuous DeploymentDevOpsAutomation

skill: CI/CD Pipelines category: DevOps tags: [CI/CD, GitHub Actions, Continuous Deployment, DevOps, Automation] readingTime: 6

CI/CD is the delivery heartbeat - every commit should be verifiably deployable. A pipeline that takes > 10 minutes destroys developer flow; one with poor test coverage gives false confidence. Optimize for fast feedback (fast tests first), reliable deployments (health checks, rollback), and clear failure messages (not 'something went wrong').

Workflow

Structure your GitHub Actions workflowA well-structured workflow provides fast feedback - lint and type-check first, then tests, then deploy - failing fast at the cheapest step.
Manage secrets and environment variablesHardcoded secrets in workflows or code are exposed in logs and git history - even if removed later. Use GitHub Secrets for all sensitive values.
Implement deployment strategiesDeploying directly to production with no validation risks serving broken code to all users. Blue-green and canary deployments reduce blast radius.
Cache dependencies for faster buildsInstalling npm/pip dependencies on every CI run wastes 2-4 minutes. Caching makes installs near-instant if the lockfile hasn't changed.
Monitor and improve pipeline performanceA pipeline that takes 20 minutes makes developers wait and discourages frequent commits. Measure, identify bottlenecks, and optimize.

Output Format

GitHub Actions CI/CD: parallel lint/test jobs, environment secrets, deployment with health check, and dependency caching.

.github/workflows/ci.yml:
  on: [push:main, pull_request:main]
  jobs:
    lint: [checkout, setup-node, npm ci, lint, type-check]
    test:  [checkout, setup-node, npm ci, test --coverage]
    deploy: needs:[lint,test], if:main → [build, deploy, smoke-test]

Examples

Input

Output

Edge Cases & Gotchas

Flaky tests in CI - Flaky tests that fail ~10% of the time erode trust in CI and cause reruns. Track flaky tests with a quarantine tag, fix them within one sprint, and never skip them permanently.
Secrets in pull requests from forks - GitHub doesn't pass repository secrets to workflows triggered by pull_request from forks (security restriction). Use pull_request_target carefully - it runs in the base repo context.
Concurrent deploys race condition - Two PRs merged quickly can trigger concurrent deploys that race to production. Use concurrency groups: concurrency: { group: production, cancel-in-progress: false } to serialize.
Pipeline cost - GitHub Actions charges per minute for private repos. Large matrix builds (40 jobs × 10 min) cost $400+/month. Cache aggressively, parallelize within a job instead of with matrix, and use merge queues.

When to Break These Rules

Use CircleCI or Buildkite instead of GitHub Actions for very long pipelines (> 60 min) or custom runner fleets - they have better observability and persistent caching.
Use Argo Workflows for complex Kubernetes-native pipelines with DAG dependencies, artifact passing, and retry strategies that GitHub Actions can't express cleanly.

Reference Files

https://docs.github.com/en/actions
https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/caching-dependencies-to-speed-up-workflows