CI/CD Pipeline Patterns

Principles for CI/CD pipeline design. Assumes trunk-based development (single main branch, no Git Flow).

Pipeline Stage Ordering

Security scanning runs BEFORE tests and builds. A vulnerability found after a 20-minute test suite wastes CI minutes.

checkout -> security-scan -> test -> build -> deploy -> verify

Security Scanning Order

Run scans in order of speed and severity impact:

1. SAST (Static Analysis) -- Fastest, catches code-level vulnerabilities
2. Secrets scanning -- Prevents credential leaks before they reach remote
3. Dependency scanning -- Identifies known CVEs in dependencies
4. Container scanning -- Scans built images for OS-level vulnerabilities (runs after build stage)

For security scanning tool details, see security-patterns skill.

GitHub Actions Patterns

Trunk-Based Pipeline Structure

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  security-scan:
    # Runs first, no dependencies
  test:
    needs: security-scan
  build:
    needs: test
  deploy:
    needs: build
    if: github.ref == 'refs/heads/main'  # Deploy only from main

Key Principles

• Pin action versions by SHA, not tag (e.g., actions/checkout@<sha> not @v4). Tags are mutable.
• Minimize secret exposure: Use environment protection rules. Restrict deploy secrets to the deploy job only.
• Cache dependencies between jobs to reduce build time (actions/cache or setup-* cache options).
• Fail the pipeline on audit warnings for production branches. Use --audit-level high or equivalent.

Deployment Strategies

Decision Heuristic

For zero-downtime database migrations during deployments, see database-patterns skill.

Anti-Patterns