CI/CD

Overview

Pipeline design, security hardening, and optimization across GitHub Actions, GitLab CI, Jenkins, CircleCI, and cloud-native platforms. The load-bearing content is Expert Practices (bottom) — supply-chain, least-privilege, OIDC, cache trust boundaries, and platform gotchas. Read that section for any non-trivial pipeline.

Design Principles

• Fail fast, cheap-first: lint → typecheck → unit → integration → build → deploy. A stage should only run if everything cheaper passed.
• Parallelize independent work; shard slow test suites across runners; matrix multi-version/OS.
• Cache by lock-file hash, scoped by OS — never by branch (see cache gotcha). Cache deps, build output, Docker layers.
• Build once, promote by digest — never rebuild per environment (see Design Patterns). What you validated in staging must be the exact bytes that reach prod.
• Least privilege: permissions: {} default, grant per-job; OIDC not stored cloud keys; pin actions by SHA.
• Every deploy reversible; pipelines idempotent/re-runnable; manual approval gates for prod via environments.
• Shift security left: SAST/secret/dependency scans early; container scan pre-push; block on CRITICAL/HIGH.

Deployment strategies