Continuous Integration merges code frequently and verifies it automatically. Continuous Deployment then ships it to production. Together they enable safe, fast changes.
11.3 CI/CD
CI - keeping the codebase always shippable
Trunk-based development; short-lived branches.
Pull request with required checks.
Automated tests on every push.
Static analysis (lint, SAST).
Build artefact stored; immutable.
Pipeline shape
CD - shipping it safely
Style
What is shipped
Continuous Delivery
Auto-deploys to staging; manual to prod
Continuous Deployment
Every green main reaches production
Progressive delivery
Canary, blue-green, feature flags
Quality gates
Gate
Tool examples
Tests
Unit + integration + smoke
Coverage
Floor on critical paths
SAST
Semgrep, CodeQL
SCA
Dependabot, Snyk
DAST
OWASP ZAP
Container scan
Trivy, Grype
Policy
OPA / Conftest for IaC
Rollback patterns
Pattern
Mechanism
Blue-green
Two stacks; switch traffic
Canary
Small % to new; auto-roll back on SLO breach
Feature flag
Toggle code path off without redeploy
Common pitfalls
Long-running branches; merge hell.
Pipelines slow; engineers bypass them.
No rollback plan; first incident is also the first rollback drill.
Secrets in plaintext in CI variables.
Mentor’s tip: Trunk + short branches + automated checks = CI. Canary + flags + auto-rollback = safe CD. Pipelines are audit artefacts in regulated industries; treat them with the same rigor as production code.
Discussion
Loading…