tomevault-io Overview
CI/CD pipelines automate the path from commit to deployment. This skill covers the full pipeline: fast CI checks, deployment strategies, pre-launch verification, rollback planning, and post-deploy monitoring.
When to Use
- When setting up or modifying a CI/CD pipeline
- Before deploying to production
- When releasing a new version
- During
/shipphase
Process
1. CI Pipeline Stages
stages:
- lint # Code style + static analysis (< 1 min)
- test # Full test suite (< 5 min target)
- build # Compile/bundle (< 2 min)
- security # Dependency audit + SAST (< 2 min)
Key principles: Fast feedback (< 10 min total), fail fast (cheapest checks first), deterministic (no flaky tests), branch protection (main requires passing CI).
2. Security in CI
security:
- npm audit --audit-level=high
- npx secretlint "**/*"
3. Deployment Strategies
| Strategy | Risk | Rollback | Use When |
|---|---|---|---|
| Blue-green | Low | Instant | Production services |
| Canary | Low | Fast | High-traffic services |
| Rolling | Medium | Moderate | Stateless services |
| All-at-once | High | Slow | Dev/staging only |
4. Pre-Launch Checklist
- All tests pass on the release branch
- Build succeeds with no warnings
- Security audit clean (no critical/high)
- Code review approved
- Staging environment tested
- Rollback plan documented
- Monitoring/alerting configured
5. Rollback Plan
Before deploying, document:
- How to detect a failed deployment (metrics, alerts)
- How to rollback (command, process, timeline)
- Who to notify if rollback is needed
6. Post-Deploy Verification (within 15 min)
- Health check endpoint returns 200
- Core user flows work
- Error rates and response times normal
- Logs clean (no unexpected errors)
Common Rationalizations
| Rationalization | Reality |
|---|---|
| "CI is too slow, I'll push directly" | Fix the slow pipeline, don't bypass it. |
| "It worked on staging, it'll work in production" | Staging ≠ production. Different data, load, and config. Verify after deploy. |
| "We don't need a rollback plan" | Murphy's Law. 5 minutes of planning saves hours of panic. |
Red Flags
- No CI pipeline for multi-contributor projects
- Pipeline takes > 15 minutes
- Main branch unprotected
- Deploying without rollback plan
- Deploying on Friday afternoon
- No post-deploy verification
Verification
- CI pipeline runs lint, test, build, and security stages
- Pipeline completes in < 10 minutes
- Pre-launch checklist complete
- Rollback plan documented
- Post-deploy verification passed
See Also
codehands:git-workflow-and-versioning— Git conventions for CIcodehands:finishing-a-development-branch— Branch completion flowcodehands:security-and-hardening— Security scanning details
Source: VidyaBodepudi/Code-Skills — distributed by TomeVault.