CI/CD Best Practices

A condensed summary of the 25 most important CI/CD practices for Node.js teams - drawn from every page in this section.

How to Use This List

• Enable branch protection requiring all gate checks
• Document rollback: redeploy previous SHA digest in under 15 minutes
• Pair with Docker Best Practices for image scan gates

1. Separate PR CI from release CD: Validate on PR; deploy on merge/tag - CI/CD Basics.

2. Deploy the same artifact tested in CI: Same Docker digest or Lambda zip SHA from test job to prod.

3. Immutable tags: ghcr.io/acme/api:${{ github.sha }}, not :latest alone.

4. npm ci in CI always: Lockfile committed; no npm install.

5. Node 24 in CI: Match production runtime; matrix 22 if still supporting - GitHub Actions for Node.

6. Cache npm via setup-node: Lockfile-hash cache keys.

7. Fail fast gate order: lint, typecheck, then test - Quality Gates.

8. --max-warnings 0 on ESLint: Warnings are failures in CI.

9. Explicit tsc --noEmit: Even when build emits JS.

10. Coverage thresholds or diff coverage: Prevent untested critical paths.

11. npm audit --audit-level=high: Pair with Renovate for fixes.

12. Scan containers with Trivy/Grype: Fail on critical CVEs before push.

13. Concurrency cancel in-progress: Save minutes on active PR branches.

14. OIDC to AWS/GCP/Azure: No static cloud keys in GitHub secrets.

15. Environment protection rules: Required reviewers for production deploy job.

16. Smoke test after staging deploy: curl /health and one business flow.

17. Semantic versioning automation optional: Semantic Release when Conventional Commits are enforced.

18. Conventional Commits or squash title policy: Predictable changelog and semver.

19. Preview environments with cleanup: Delete namespace/stack on PR close - Preview Environments.

20. Path filters for expensive jobs: Docker build when Dockerfile or src/ changes.

21. Integration tests with service containers: Postgres/Redis in workflow, not mocked only.

22. Artifacts between jobs: Upload dist/ or function.zip for deploy job consumption.

23. No deploy from laptops: Break-glass documented and rare.

24. Document rollback runbook: Previous image digest redeploy - On-Call Runbook Starters.

25. DORA metrics tracked: Deployment frequency and change failure rate - DORA Metrics for Node Teams.

FAQs

Related

• CI/CD Basics - pipeline model
• GitHub Actions for Node - workflow examples
• Quality Gates - required checks
• Zero-Downtime Deploys - safe production rollout
• Platform Deploy Best Practices - runtime checklist

Stack versions: This page was written for Node.js 24.18.0 (Active LTS), npm 10+, TypeScript 5.6+, Express 5, Fastify 5, and NestJS 11.