CI/CD Best Practices
A condensed summary of the 25 most important CI/CD practices for Node.js teams - drawn from every page in this section.
//
Search across all documentation pages
A condensed summary of the 25 most important CI/CD practices for Node.js teams - drawn from every page in this section.
Separate PR CI from release CD: Validate on PR; deploy on merge/tag - CI/CD Basics.
Deploy the same artifact tested in CI: Same Docker digest or Lambda zip SHA from test job to prod.
Immutable tags: ghcr.io/acme/api:${{ github.sha }}, not :latest alone.
npm ci in CI always: Lockfile committed; no npm install.
Node 24 in CI: Match production runtime; matrix 22 if still supporting - GitHub Actions for Node.
Cache npm via setup-node: Lockfile-hash cache keys.
Fail fast gate order: lint, typecheck, then test - Quality Gates.
--max-warnings 0 on ESLint: Warnings are failures in CI.
Explicit tsc --noEmit: Even when build emits JS.
Coverage thresholds or diff coverage: Prevent untested critical paths.
npm audit --audit-level=high: Pair with Renovate for fixes.
Scan containers with Trivy/Grype: Fail on critical CVEs before push.
Concurrency cancel in-progress: Save minutes on active PR branches.
OIDC to AWS/GCP/Azure: No static cloud keys in GitHub secrets.
Environment protection rules: Required reviewers for production deploy job.
Smoke test after staging deploy: curl /health and one business flow.
Semantic versioning automation optional: Semantic Release when Conventional Commits are enforced.
Conventional Commits or squash title policy: Predictable changelog and semver.
Preview environments with cleanup: Delete namespace/stack on PR close - Preview Environments.
Path filters for expensive jobs: Docker build when Dockerfile or src/ changes.
Integration tests with service containers: Postgres/Redis in workflow, not mocked only.
Artifacts between jobs: Upload dist/ or function.zip for deploy job consumption.
No deploy from laptops: Break-glass documented and rare.
Document rollback runbook: Previous image digest redeploy - On-Call Runbook Starters.
DORA metrics tracked: Deployment frequency and change failure rate - DORA Metrics for Node Teams.
Promote the exact artifact (image digest or zip) that passed CI gates. Never rebuild differently for production.
Separate files (ci.yml, release.yml) improve clarity and permission boundaries.
Under 10 minutes for unit gates. Split slow E2E to nightly if needed.
Valuable for full-stack review; optional for internal APIs with strong integration tests.
Release pipeline against staging first, then prod, as a gated job before traffic shift - not ad hoc locally.
Stack versions: This page was written for Node.js 24.18.0 (Active LTS), npm 10+, TypeScript 5.6+, Express 5, Fastify 5, and NestJS 11.
Reviewed by Chris St. John·Last updated Jul 16, 2026