CI/CD Patterns

CI/CD Patterns

Best practices and anti-patterns for CI/CD pipelines, focusing on GitHub Actions but applicable to other CI systems.

Purpose

• Ensure pipelines are fast, reliable, and secure
• Prevent common mistakes that cause build failures or security issues
• Establish patterns for maintainable pipeline configurations

Core Patterns

Pattern 1: Parallel Job Execution

When to use: Multiple independent tasks in pipeline.

Implementation:

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm run lint

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm test

  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm run build

  # Only deploy after all checks pass
  deploy:
    needs: [lint, test, build]
    runs-on: ubuntu-latest
    steps:
      - run: ./deploy.sh

Benefits:

• Faster pipeline execution
• Early failure detection
• Clear dependency visualization

Pattern 2: Dependency Caching

When to use: Repeated dependency installation across runs.

Implementation:

- name: Cache dependencies
  uses: actions/cache@v4
  with:
    path: ~/.npm
    key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-node-

- name: Install dependencies
  run: npm ci

Benefits:

• 60-80% faster builds
• Reduced network usage
• Consistent dependency versions

Pattern 3: Matrix Builds

When to use: Testing across multiple versions/platforms.

Implementation:

strategy:
  matrix:
    node: [18, 20, 22]
    os: [ubuntu-latest, macos-latest]
  fail-fast: false

runs-on: ${{ matrix.os }}
steps:
  - uses: actions/setup-node@v4
    with:
      node-version: ${{ matrix.node }}

Anti-Patterns

Anti-Pattern 1: Hardcoded Secrets

Bad Example:

- name: Deploy
  run: |
    curl -H "Authorization: Bearer ghp_xxxxxxxxxxxx" \
      https://api.github.com/repos/owner/repo/deployments

Good Example:

- name: Deploy
  run: |
    curl -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
      https://api.github.com/repos/owner/repo/deployments

Anti-Pattern 2: No Build Caching

Bad Example:

steps:
  - uses: actions/checkout@v4
  - run: npm install
  - run: npm test

Good Example:

steps:
  - uses: actions/checkout@v4
  - uses: actions/cache@v4
    with:
      path: ~/.npm
      key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
  - run: npm ci
  - run: npm test

Anti-Pattern 3: Missing Health Checks

Bad Example:

deploy:
  steps:
    - name: Deploy
      run: kubectl apply -f deployment.yaml
    # No verification!

Good Example:

deploy:
  steps:
    - name: Deploy
      run: kubectl apply -f deployment.yaml

    - name: Wait for rollout
      run: kubectl rollout status deployment/app --timeout=5m

    - name: Health check
      run: |
        curl -f https://app.example.com/health || exit 1

    - name: Rollback on failure
      if: failure()
      run: kubectl rollout undo deployment/app

Anti-Pattern 4: Sequential Independent Jobs

Bad Example:

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - run: npm run lint

  test:
    needs: lint  # Unnecessary dependency!
    runs-on: ubuntu-latest
    steps:
      - run: npm test

Good Example:

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - run: npm run lint

  test:
    runs-on: ubuntu-latest  # Runs in parallel
    steps:
      - run: npm test

Anti-Pattern 5: No Timeout Configuration

Bad Example:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - run: npm test  # Could hang forever

Good Example:

jobs:
  build:
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
      - name: Run tests
        timeout-minutes: 15
        run: npm test

Validation Checklist

Pre-Implementation

• Review existing pipeline structure
• Identify parallelization opportunities
• Check current build times for baseline

Implementation

• All secrets use ${{ secrets.NAME }} syntax
• Dependency caching configured
• Independent jobs run in parallel
• Timeouts set on jobs and long-running steps
• Health checks after deployments
• Rollback mechanism in place

Post-Implementation

• Build times improved or maintained
• No secrets exposed in logs
• Pipeline passes consistently
• Deployment verification works

Quick Reference