ci-cd-pipeline-design

Start by selecting an architecture pattern: linear for simple apps, parallel for faster feedback, or fan-out/fan-in for monorepos. Then configure build, test, security, and deploy stages with caching, coverage gates, and environment promotion from staging to production.

Blue-green deployment runs two full environments and switches all traffic at once, keeping the old version for instant rollback. Canary deployment routes a small percentage of traffic to the new version first, gradually increasing while monitoring error rates.

Add a security job with CodeQL for SAST, npm audit or Snyk for dependency scanning, Gitleaks for secret detection, and Trivy for container image scanning. Configure the job to fail on critical or high severity findings before deployment.

GitHub Actions integrates natively with GitHub repositories using YAML workflows. GitLab CI offers built-in security scanning templates and Kubernetes deployment. Jenkins provides maximum flexibility through Groovy pipelines but requires self-hosted maintenance.

Slow pipelines usually result from sequential execution, missing dependency caches, and running all tests on every change. Parallelize independent jobs, cache package manager dependencies, use path filters for selective execution, and keep total CI time under 10 minutes.

Store secrets in native platform stores like GitHub Secrets or GitLab CI Variables, never in the repository. Scope secrets to specific environments, rotate them regularly, and audit access logs for unusual activity.