CI/CD Pipeline Practice

• · CD1 — Pipeline stages are ordered cheapest/fastest first (lint, typecheck, unit tests) before expensive/slow stages (build, E2E, deploy).
• · CD2 — A red pipeline blocks merge; main only ever contains commits that passed the full gate.
• · CD3 — Pipeline runtime is actively budgeted and optimized (parallelization, caching); a slow pipeline invites bypass under deadline pressure.
• · CD4 — Deployment is automated end-to-end from a passing pipeline — no manual deploy steps that can drift from what was tested.
• · CD5 — Deploys are decoupled from releases where feature flags are available: ship code continuously, expose it to users deliberately.

• · Pipeline taking >10-15 minutes → identify the slowest stage, parallelize or cache it, or move it later in the sequence.
• · A "temporary" manual deploy step still in place months later → automate it now, it's accumulating risk every release.
• · Pipeline config containing a hardcoded API key/token → move to the CI platform's secret store immediately.
• · A rollback that requires SSHing into a server and running commands from memory → automate it into a one-command/one-click action before the next incident.
• · main red for more than a few minutes → treat as an incident (stop-the-line), don't let it linger while new work piles on top.

• · Slow-pipeline bypass — a 45-minute pipeline routinely skipped or merged around under deadline pressure, defeating its entire purpose.
• · Snowflake manual deploys — production deployment involving a person SSHing in and running commands from memory/a wiki page, different every time.
• · Secrets in pipeline YAML — API keys/deploy credentials committed directly in CI config files.
• · Untested rollback — a documented rollback procedure nobody has actually run since it was written, discovered broken during a real incident.
• · Red main tolerated — the main branch pipeline failing for days while work continues to pile on top, normalizing a broken build state.

• [ ] Pipeline stages ordered fast-first (lint/typecheck/unit before build/E2E). (CI-E1)
• [ ] Branch protection requires pipeline pass before merge. (CI-E2)
• [ ] Secrets in CI platform's secret manager, not committed config. (CI-E3)
• [ ] Production deploy automated from a passing pipeline. (CI-E4)
• [ ] Rollback is a single tested automated action. (CI-E5)
• [ ] Pipeline caching keeps runtime reasonable. (CI-E6)

• Continuous Delivery: Reliable Software Releases through Build, Test, and Deployment Automation

Este pack cita las siguientes fuentes registradas en el índice bibliográfico:

• bookContinuous Delivery: Reliable Software Releases through Build, Test, and Deployment AutomationJez Humble & David Farley. Addison-Wesley