CI/CD Highlights Summary

Every highlight bullet from the 7 pages in this section, gathered on one page and grouped by the page it came from.

The CI/CD Delivery Pipeline

• CI answers 'is this change safe to merge'; CD answers 'is this change safe to release' - different questions, different pipelines
• A pipeline's job is to build one immutable artifact and prove the same artifact through every environment
• A gate is any automated check that can block a merge or a deploy - lint, tests, types, security scans
• Continuous delivery means always deployable; continuous deployment means every passing change actually deploys

CI/CD Basics

• PR pipeline: lint, test, typecheck on every push
• Release pipeline: build artifact, scan, deploy to staging then prod
• Never deploy from a laptop; promote the same SHA artifact
• Cache npm with lockfile hash keys in GitHub Actions
• Matrix Node 24 LTS (and optionally 22) for compatibility
• Separate workflows: ci.yml vs release.yml

GitHub Actions for Node

• Test matrix with Node 22 and 24 for LTS compatibility
• Always use npm ci instead of npm install for reproducible CI
• Enable npm cache in setup-node keyed on lockfile
• Set fail-fast false to see all Node version test results
• Always tag with github.sha not just latest for rollback capability
• Use concurrency to cancel superseded pull request runs

Quality Gates

• Run lint, typecheck, tests, and audit before any production deploy
• Use npm audit --audit-level=high to reduce transitive dependency noise
• Run explicit typecheck in CI even when build emits types via --noEmit
• Configure Docker scanning on pull requests when Dockerfile changes
• Enforce package-lock.json in repo for npm ci and meaningful audits
• Order gates by speed: lint first, integration tests after unit tests

Semantic Release

• feat: triggers minor, fix: triggers patch, BREAKING CHANGE footer triggers major
• Enforce Conventional Commits in PR titles to survive squash merges
• Use npmPublish: false for apps; version bump and GitHub release only
• Require fetch-depth: 0 for full commit history or analyzer sees one commit
• Add [skip ci] to bot commits to prevent infinite CI loop on version bump
• Use multi-semantic-release or Nx for per-package semver in monorepos

Preview Environments

• Deploy ephemeral full stack per pull request for real-URL API testing
• Clean up previews on PR close to prevent cluster cost exhaustion
• Match production environment: same Node image, env names, health probes
• Avoid production secrets in preview environments
• Choose preview data strategy: shared DB, branch DB, ephemeral postgres, or seeds
• Limit concurrent previews and auto-delete after 7 days inactivity for cost control

CI/CD Best Practices

• PR pipeline validates; release pipeline deploys immutable artifacts
• Tag Docker images and Lambda zips with git SHA
• Quality gates: lint, typecheck, test, audit before build
• npm ci only; lockfile required in repo
• OIDC to cloud providers; no long-lived CI secrets
• Preview environments cleaned up on PR close