CI/CD pipelines, from commit to canary

HOW IT FITS TOGETHER

KEY TERMS

CI, continuous delivery, continuous deployment

Continuous integration merges small changes to main frequently and verifies each one automatically. Continuous delivery keeps main always releasable, with a human deciding when to release. Continuous deployment removes that gate: every change that passes the pipeline goes to production. Deployment (code running) and release (users seeing it) can be separated with flags.

Build once, promote by digest

Rebuilding per environment means production runs something staging never tested (new transitive dependency, different base image). Build one artifact, address it by content digest, inject environment config at deploy time, and promote that digest. Rollback becomes re-pointing to the previous digest.

Cache vs artifact

A cache is a speed-up keyed on inputs (the lockfile hash) that may be missing or evicted; correctness must never depend on it. An artifact is a job output passed to later jobs or kept as the release. Never cache build outputs you then ship without rebuilding or verifying.

OIDC federation instead of stored keys

The job requests a short-lived signed JWT from the CI provider (GitHub needs permissions: id-token: write) and exchanges it with the cloud for temporary credentials. The cloud trust policy checks claims such as sub (repo, branch or environment), so only a specific workflow on a specific ref can assume the deploy role.

Supply-chain hardening

Third-party actions run with your token and secrets. Pin them to full commit SHAs (tags are mutable), keep GITHUB_TOKEN read-only by default, avoid pull_request_target with untrusted checkouts, and pass untrusted strings through env vars rather than interpolating them into run scripts. SLSA Build L2 adds signed provenance from a hosted builder; L3 adds isolation from user-defined steps.

Progressive delivery

Canary and blue/green turn a deploy into a measured experiment: shift a slice of traffic, compare error rate and latency against the stable version, then promote or abort. The analysis must be automated and tied to SLOs, or the canary is just a slow rollout.

Rollback compatibility

You can only roll back code if the previous version still works with the current data. Use expand/contract migrations (add columns, dual-write, backfill, switch reads, remove later) so schema changes ship separately from, and before, the code that needs them.

IN YOUR STACK

name: ci
on:
  pull_request:
  push:
    branches: [main]
permissions:
  contents: read # read-only GITHUB_TOKEN unless a job asks for more
concurrency:
  group: ci-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }} # never cancel a deploy on main
jobs:
  verify:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - uses: pnpm/action-setup@73e46992e05b19abd31f2f3c20e0e7370d762115 # v6.1.1, reads packageManager
      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with: { node-version: 24, cache: pnpm } # caches the pnpm store, keyed on pnpm-lock.yaml
      - run: pnpm install --frozen-lockfile
      - run: pnpm lint && pnpm typecheck && pnpm test
      - run: pnpm build
      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
        with:
          name: dist-${{ github.sha }}
          path: dist/

  deploy:
    needs: verify
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-24.04
    environment: production # required reviewers and env secrets live here
    permissions:
      id-token: write # lets the job mint an OIDC JWT; grants no repo write access
      contents: read
    steps:
      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
        with: { name: "dist-${{ github.sha }}", path: dist/ }
      - uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
        with:
          role-to-assume: arn:aws:iam::123456789012:role/web-deploy-prod
          aws-region: eu-west-1
      - run: aws s3 sync dist/ s3://example-web-prod --delete

# IAM role trust policy, Condition.StringEquals:
#   "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
#   "token.actions.githubusercontent.com:sub": "repo:my-org/web:environment:production"
# Repos created after 2026-07-15 use the immutable form:
#   "repo:my-org@<owner-id>/web@<repo-id>:environment:production"

name: release
on:
  push:
    tags: ["v*"]
permissions: {} # nothing by default; each job opts in
jobs:
  build:
    runs-on: ubuntu-24.04
    permissions:
      contents: read
      id-token: write          # Sigstore signing certificate
      attestations: write      # store the attestation
      artifact-metadata: write # artifact storage record
    steps:
      # Full commit SHAs: a tag can be moved to malicious code, a SHA cannot.
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with: { persist-credentials: false } # don't leave the token in .git/config
      - run: make dist/app.tar.gz
      - uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
        with:
          subject-path: dist/app.tar.gz # SLSA build provenance by default

# Consumer, before deploying:
#   gh attestation verify dist/app.tar.gz -R my-org/my-repo

apiVersion: argoproj.io/v1alpha1
kind: Rollout # replaces the Deployment; spec.template is unchanged
metadata: { name: orders }
spec:
  strategy:
    canary:
      analysis: # background analysis; failure aborts and shifts traffic back
        templates: [{ templateName: success-rate }]
        startingStep: 1
      steps:
        - setWeight: 10
        - pause: { duration: 10m }
        - setWeight: 50
        - pause: { duration: 10m }
        - pause: {} # waits for: kubectl argo rollouts promote orders
---
apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata: { name: success-rate }
spec:
  metrics:
    - name: success-rate
      interval: 2m
      failureLimit: 1
      successCondition: result[0] >= 0.99
      provider: { prometheus: { address: "http://prometheus.monitoring:9090", query: "sum(rate(http_requests_total{app=\"orders\",code!~\"5..\"}[2m])) / sum(rate(http_requests_total{app=\"orders\"}[2m]))" } }

stages: [build, deploy]
default:
  image: ghcr.io/pnpm/pnpm:12
  before_script:
    - pnpm config set store-dir .pnpm-store
    - pnpm runtime set node 24 -g
build:
  stage: build
  cache: { key: { files: [pnpm-lock.yaml] }, paths: [.pnpm-store] }
  script:
    - pnpm install --frozen-lockfile
    - pnpm lint && pnpm test && pnpm build
  artifacts: { paths: [dist/], expire_in: 1 week }
deploy-production:
  stage: deploy
  image: { name: amazon/aws-cli:latest, entrypoint: [""] } # the image's entrypoint is aws; pin a digest in real pipelines
  before_script: []
  environment: production
  rules:
    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
      when: manual # continuous delivery: a human presses deploy
  id_tokens:
    GITLAB_OIDC_TOKEN: { aud: https://gitlab.example.com }
  script:
    - eval "$(./scripts/assume-role.sh "$GITLAB_OIDC_TOKEN")" # prints export AWS_... lines
    - aws s3 sync dist/ s3://example-web-prod --delete

  deploy-worker:
    needs: verify
    runs-on: ubuntu-24.04
    environment: production
    permissions: { contents: read }
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - id: upload # new version, receives no traffic yet
        uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: versions upload --tag ${{ github.sha }} --message "${{ github.sha }}"
      - run: ./scripts/check-version.sh # smoke test via a preview URL
      - uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
        with:
          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
          command: versions deploy ${{ env.NEW_VERSION_ID }}@10% ${{ env.STABLE_VERSION_ID }}@90% -y

# Roll back instantly to the previous version (all routes at once):
#   pnpm wrangler rollback --message "error rate above SLO"

WHEN TO REACH FOR WHAT

WHERE IT BITES

• Rebuilding the artifact per environment. Production then runs bytes nobody tested; build once and promote by digest.
• Long-lived cloud keys stored as CI secrets. They leak through logs, forks and compromised actions; federate with OIDC and constrain the sub claim.
• Referencing third-party actions by tag. Tags are mutable, and a compromised tag runs attacker code with your secrets; pin full SHAs or adopt the workflow lockfile.
• Interpolating untrusted context (PR titles, branch names) directly into run: scripts, or checking out fork code under pull_request_target. Both turn a PR into code execution with write tokens.
• Shipping a schema change and the code that needs it in one deploy. The rollback then breaks against the migrated database; use expand/contract.
• A rollback path nobody has exercised. If reverting requires a new build or a manual console session, it will be slow exactly when it matters.

WHEN IT BREAKS IN PRODUCTION

• Nobody knows which feature flags are safe to remove
• A routine dependency update ships malicious code
• Rolling back a deploy fails because the schema already changed
• Users see an old version or chunks fail to load after a deploy
• An API key ended up in the repo or the browser bundle
• A migration locks a table and requests pile up

SOURCES

• GitHub Docs: Secure use reference (opens in new tab)Checked 2026-11-06
• GitHub Docs: OpenID Connect reference (opens in new tab)Checked 2026-11-06
• GitHub Docs: Workflow dependency lockfiles (opens in new tab)Checked 2026-11-06
• SLSA v1.2: Build track basics (opens in new tab)Checked 2026-11-06
• Argo Rollouts: Canary deployment strategy (opens in new tab)Checked 2026-11-06
• GitLab Docs: Configure OpenID Connect in AWS (opens in new tab)Checked 2026-11-06