pipeline-blueprint

CI/CD Configuration Best Practices

This skill provides CI/CD pipeline templates and best practices for GitHub Actions and GitLab CI. It recommends configurations based on project type, helping teams quickly set up reliable, secure, and efficient pipelines.

How to Use

When a user describes their project (language, framework, deployment target), recommend the most appropriate pipeline template below. Adapt stages, caching strategies, and deployment steps to match their stack.

---

General Best Practices

Pipeline Design Principles

1. Fail fast: Run linting and unit tests before expensive integration or E2E tests.
2. Cache aggressively: Cache dependency directories (node_modules, .pip_cache, .m2, .gradle) to speed up builds.
3. Pin versions: Pin CI runner images, tool versions, and action versions to SHA or exact tags — never use latest.
4. Least privilege: Use minimal permissions for tokens and credentials. Prefer OIDC over long-lived secrets where supported.
5. Parallelize: Split test suites across parallel jobs. Use matrix builds for multi-version testing.
6. Immutable artifacts: Build once, promote the same artifact through staging → production.
7. Branch protection: Require CI to pass before merging. Use status checks on the default branch.

Security Checklist

• Never hardcode secrets in pipeline files; use the platform's secret management (GitHub Secrets / GitLab CI Variables).
• Audit third-party actions/images before use. Prefer official or verified sources.
• Enable dependency scanning (Dependabot, GitLab Dependency Scanning) and SAST where possible.
• Restrict who can trigger production deployments.
• Rotate secrets on a regular cadence.

---

Project Type Templates

1. Frontend (React / Vue / Angular / Static Sites)

Key stages: Install → Lint → Test → Build → Deploy

GitHub Actions

name: Frontend CI/CD

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

permissions:
  contents: read

jobs:
  ci:
    runs-on: ubuntu-22.04
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20
          cache: npm

      - run: npm ci

      - run: npm run lint

      - run: npm test -- --coverage

      - run: npm run build

      - uses: actions/upload-artifact@v4
        with:
          name: dist
          path: dist/

  deploy:
    needs: ci
    if: github.ref == 'refs/heads/main' && github.event_name == 'push'
    runs-on: ubuntu-22.04
    environment: production
    steps:
      - uses: actions/download-artifact@v4
        with:
          name: dist
          path: dist/

      # Replace with your deployment step (e.g., S3 sync, Cloudflare Pages, Vercel)
      - name: Deploy
        run: echo "Add your deployment command here"