| name | ci-cd-patterns |
| version | 1.0.0 |
| description | CI/CD pipeline patterns for reliable builds, tests, artifacts, deployments, environment promotion, supply-chain security, and rollback-safe delivery. |
| author | skillregistry |
| license | MIT |
| agents | ["cursor"] |
| categories | ["devops"] |
| tags | ["devops","ci","cd"] |
CI/CD Patterns
Build pipelines that prove a change is safe before release and make deployment reversible. Keep CI deterministic, fast, and least-privileged.
Workflow
- Identify required quality gates: format, lint, typecheck, tests, build, image scan, contract tests.
- Run fast checks first and avoid deployment work on untrusted pull requests.
- Build immutable artifacts once; promote the same artifact across environments.
- Use environment-scoped secrets and approvals for production.
- Publish test reports, coverage, SBOM/provenance, and deployment metadata.
- Define rollback before deploying.
Pipeline Shape
pull_request:
install -> lint -> typecheck -> unit tests -> build
main:
install -> full test -> build artifact/image -> scan -> publish -> deploy staging
release:
promote known artifact -> deploy prod -> smoke test -> monitor -> rollback if needed
Production Rules
- Use lockfile-based installs:
pnpm install --frozen-lockfile.
- Cache package stores, not
node_modules, unless the platform explicitly supports it safely.
- Give jobs explicit permissions; default to read-only.
- Use OIDC federation for cloud deploys instead of long-lived cloud keys.
- Pin third-party actions/images by version or digest according to risk policy.
- Never deploy from unreviewed fork PR contexts.
- Keep secrets out of logs and build arguments.
Example Commands
pnpm install --frozen-lockfile
pnpm typecheck
pnpm test -- --run
pnpm build
docker buildx build --provenance=true --sbom=true .
Verification
- Confirm CI fails on type errors and test failures.
- Confirm production deploy requires protected branch/environment.
- Confirm artifact digest is the same across staging and production.
- Confirm rollback command works from a clean terminal.
Resources
Principles
- CI proves; CD promotes.
- Build once, deploy many.
- Least privilege for every job.
- Rollback is part of delivery.
- Reproducibility beats clever caching.
