# CI CD Patterns

> When to activate: CI/CD, pipeline, continuous integration, continuous deployment, blue-green, canary, rolling deployment, staging, release

- Skill: `mattakushi432/ci-cd-patterns` (Agent Skill)
- Install (CLI): `npx skillmds@latest add mattakushi432/ci-cd-patterns`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mattakushi432/ci-cd-patterns/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: Mattakushi432 (https://skillmd.com/u/mattakushi432)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/mattakushi432/ci-cd-patterns

---

# CI/CD Patterns

## Pipeline Stages (Universal)

```
1. Lint / Format Check
2. Unit Tests
3. Build Artifact / Docker Image
4. Integration Tests
5. Security Scan (SAST/SCA)
6. Push to Registry
7. Deploy to Staging
8. Smoke Tests
9. Deploy to Production (manual gate or auto)
10. Post-deploy Health Check
```

## Blue-Green Deployment

```bash
# Two identical environments; switch traffic at load balancer
# Blue = current live, Green = new version

# 1. Deploy new version to Green
kubectl apply -f deployment-green.yaml

# 2. Wait for Green to be ready
kubectl rollout status deployment/myapp-green

# 3. Run smoke tests against Green
./scripts/smoke-test.sh https://green.internal

# 4. Switch traffic (update Service selector)
kubectl patch service myapp -p '{"spec":{"selector":{"version":"green"}}}'

# 5. Monitor — rollback in seconds if needed
kubectl patch service myapp -p '{"spec":{"selector":{"version":"blue"}}}'
```

## Canary Deployment (nginx ingress)

```yaml
# 90% → stable, 10% → canary
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp-canary
  annotations:
    nginx.ingress.kubernetes.io/canary: "true"
    nginx.ingress.kubernetes.io/canary-weight: "10"
spec:
  rules:
    - host: myapp.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: myapp-canary
                port:
                  number: 80
```

## Rolling Deployment (Kubernetes)

```yaml
strategy:
  type: RollingUpdate
  rollingUpdate:
    maxSurge: 25%        # Extra pods during update
    maxUnavailable: 0    # Never reduce capacity
```

## Artifact Versioning

```bash
# Semantic: image:1.2.3
# SHA-based (preferred for traceability):
IMAGE_TAG="${CI_COMMIT_SHA:0:8}"
docker build -t "registry/myapp:${IMAGE_TAG}" .
docker push "registry/myapp:${IMAGE_TAG}"

# Also tag with branch for humans:
docker tag "registry/myapp:${IMAGE_TAG}" "registry/myapp:main-latest"
```

## Pipeline Caching

```yaml
# GitHub Actions cache
- uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-node-

# Docker layer cache via buildx
- uses: docker/build-push-action@v5
  with:
    cache-from: type=registry,ref=registry/myapp:buildcache
    cache-to: type=registry,ref=registry/myapp:buildcache,mode=max
```

## Environment Promotion Gates

```
Dev → Staging    : auto on merge to main
Staging → Prod   : manual approval required
Prod rollback    : automated on error-rate > 1% SLO breach
```

## Rollback Strategy

```bash
# Kubernetes: rollback to previous revision
kubectl rollout undo deployment/myapp

# Rollback to specific revision
kubectl rollout history deployment/myapp
kubectl rollout undo deployment/myapp --to-revision=3

# Helm rollback
helm rollback myapp 2
```

## Feature Flags for Safe Deploys

```python
# Deploy code dark, enable via flag — decouple deploy from release
if feature_flag("new-checkout-flow", user_id=user.id):
    return new_checkout()
return old_checkout()
```

## Key Rules
- Deploy artifacts, not source code — build once, promote the same image
- Every deployment must be reversible in < 5 minutes
- Never deploy Friday afternoons or before holidays
- Use environment parity: staging should mirror prod data shape
- Tag every release with git SHA for traceability