ci-cd-pipeline

Build pragmatic CI/CD pipelines

A pipeline that runs in 2 minutes and deploys reliably beats one that does everything and breaks weekly. Detect the real stack; emit stages that match the project's actual commands.

Canonical pipeline stages

lint → test → build → scan → deploy-staging → smoke-test → deploy-prod

Not every project needs all stages. Drop what adds no signal; never skip test and lint.

Stack detection signals

File present	Inferred stack
package.json + tsconfig.json	TypeScript/Node
pom.xml	Java/Maven
build.gradle	Java/Gradle
requirements.txt / pyproject.toml	Python
go.mod	Go
Cargo.toml	Rust
Dockerfile	Container build needed
.terraform/ or *.tf	Terraform plan/apply stage

Steps

1. Detect the stack. Read package.json, pom.xml, lockfiles, and Dockerfile — do not guess. Extract the actual test, lint, and build commands from the project's own scripts.
2. Choose the minimal stage set. Map detected commands to pipeline stages. If a stage has no command, omit it — a placeholder stage that always passes adds noise.
3. Configure caching. Cache dependency directories keyed by lockfile hash (e.g. pnpm-lock.yaml, go.sum). A cache miss should still produce a correct build.
4. Add secrets hygiene. All credentials via CI secret store — never hardcoded. Mask secrets in logs. Principle of least privilege for deploy tokens.
5. Emit the pipeline file. GitHub Actions (.github/workflows/ci.yml) or GitLab CI (.gitlab-ci.yml) depending on the platform. Validate YAML syntax before committing.
6. Verify. Trigger the pipeline on a feature branch; confirm all stages pass; record timings; submit for review.

Build / Test

• Validate YAML with the platform's own linter (actionlint for GitHub Actions, gitlab-ci-lint for GitLab) before push.
• Confirm cache restores by running the pipeline twice — second run should be significantly faster.
• Deploy stages: dry-run (--dry-run or preview) first; then gate production deploy on staging smoke-test pass.