CI/CD Pipeline

Instructions

Step 1: Gather Requirements

Ask:

1. What platform? (GitHub Actions, GitLab CI, AWS CodePipeline)
2. What language/framework? (Node.js, Python, Java, Go, .NET)
3. What stages are needed? (build, test, lint, security scan, deploy)
4. Deployment targets? (ECS, Lambda, Kubernetes, S3+CloudFront, Vercel)
5. Branch strategy? (deploy on main push, tag-based releases, environment promotion)

Step 2: GitHub Actions Workflow

Generate a complete workflow file:

name: CI/CD Pipeline

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read
  id-token: write

env:
  NODE_VERSION: '20'
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - run: npm ci
      - run: npm run lint
      - run: npm run type-check

  test:
    runs-on: ubuntu-latest
    needs: lint
    services:
      postgres:
        image: postgres:16-alpine
        env:
          POSTGRES_PASSWORD: test
          POSTGRES_DB: testdb
        ports:
          - 5432:5432
        options: >-
          --health-cmd pg_isready
          --health-interval 10s
          --health-timeout 5s
          --health-retries 5
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'
      - run: npm ci
      - run: npm test -- --coverage
        env:
          DATABASE_URL: postgres://postgres:test@localhost:5432/testdb
      - uses: actions/upload-artifact@v4
        with:
          name: coverage
          path: coverage/

  security:
    runs-on: ubuntu-latest
    needs: lint
    steps:
      - uses: actions/checkout@v4
      - run: npm audit --audit-level=high
      - uses: github/codeql-action/init@v3
        with:
          languages: javascript
      - uses: github/codeql-action/analyze@v3

  build:
    runs-on: ubuntu-latest
    needs: [test, security]
    if: github.ref == 'refs/heads/main'
    outputs:
      image-tag: ${{ steps.meta.outputs.tags }}
    steps:
      - uses: actions/checkout@v4
      - uses: docker/setup-buildx-action@v3
      - uses: docker/login-action@v3
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - id: meta
        uses: docker/metadata-action@v5
        with:
          images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
          tags: |
            type=sha,prefix=
            type=raw,value=latest
      - uses: docker/build-push-action@v5
        with:
          context: .
          push: true
          tags: ${{ steps.meta.outputs.tags }}
          cache-from: type=gha
          cache-to: type=gha,mode=max

  deploy:
    runs-on: ubuntu-latest
    needs: build
    environment: production
    steps:
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-arn: ${{ secrets.AWS_ROLE_ARN }}
          aws-region: us-east-1
      - run: |
          aws ecs update-service \
            --cluster production \
            --service app \
            --force-new-deployment

Step 3: Caching Strategies

Apply appropriate caching for the language:

Node.js:

- uses: actions/setup-node@v4
  with:
    node-version: '20'
    cache: 'npm'

Python:

- uses: actions/setup-python@v5
  with:
    python-version: '3.12'
    cache: 'pip'

Go:

- uses: actions/setup-go@v5
  with:
    go-version: '1.22'
    cache: true

Docker layers:

- uses: docker/build-push-action@v5
  with:
    cache-from: type=gha
    cache-to: type=gha,mode=max

Step 4: Parallelism and Job Dependencies

Structure jobs for maximum parallelism:

lint ──┬── test ──────┬── build ── deploy-staging ── deploy-prod
       │              │
       └── security ──┘

Rules:

• Lint and type-check first (fastest, catches most issues)
• Run tests and security scans in parallel (both depend on lint)
• Build only after tests and security pass
• Deploy with environment protection rules and manual approval for production

Step 5: Environment Promotion

For multi-environment deployments:

deploy-staging:
  needs: build
  environment: staging
  # Auto-deploys on main push

deploy-production:
  needs: deploy-staging
  environment:
    name: production
    url: https://app.example.com
  # Requires manual approval via GitHub environment protection rules

Step 6: Deployment Target Configurations

AWS ECS:

- uses: aws-actions/amazon-ecs-deploy-task-definition@v1
  with:
    task-definition: task-def.json
    service: my-service
    cluster: production
    wait-for-service-stability: true

AWS Lambda:

- run: |
    zip -r function.zip .
    aws lambda update-function-code \
      --function-name my-function \
      --zip-file fileb://function.zip

Kubernetes:

- uses: azure/k8s-set-context@v3
  with:
    kubeconfig: ${{ secrets.KUBE_CONFIG }}
- run: |
    kubectl set image deployment/app \
      app=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}
    kubectl rollout status deployment/app --timeout=300s

S3 + CloudFront (static sites):

- run: |
    aws s3 sync dist/ s3://${{ vars.BUCKET_NAME }} --delete
    aws cloudfront create-invalidation \
      --distribution-id ${{ vars.CF_DISTRIBUTION_ID }} \
      --paths "/*"

Example

User says: "Create a GitHub Actions pipeline for a Python FastAPI app deploying to AWS Lambda"

Response:

• Workflow with lint (ruff), test (pytest), security (pip-audit), build, deploy stages
• Python caching with pip
• AWS OIDC authentication (no long-lived keys)
• Lambda deployment with zip packaging
• Separate staging and production environments

Guidelines

• Always use specific action versions (v4, not @main)
• Use OIDC for cloud provider authentication, never store long-lived credentials
• Run lint first because it is the fastest feedback
• Parallelize independent jobs (tests and security scans)
• Use GitHub environments with protection rules for production deployments
• Cache dependencies aggressively to reduce build times
• Set timeouts on all jobs to prevent hung workflows: timeout-minutes: 15
• Use concurrency groups to cancel outdated deployments
• Never expose secrets in logs; use ::add-mask:: if dynamic values are sensitive