CI/CD Course
CI/CD Best Practices
In this lesson
This course has covered CI/CD from first principles through enterprise deployment patterns. Every lesson has embedded specific practices within its topic context. This lesson steps back and consolidates the most important practices into a single reference — not as a checklist to implement mechanically, but as a set of principles that, when applied consistently, separate CI/CD systems that work from CI/CD systems that work well. Good practices are not rules; they are the accumulated knowledge of what tends to produce reliable, fast, secure, and maintainable delivery pipelines across the widest range of organisations and contexts.
Pipeline Design Practices
Pipeline design decisions made early compound over time — they become harder to change as the codebase, team, and service count grow. The practices below represent the structural decisions that most consistently produce pipelines that remain maintainable and effective as organisations scale.
Pipeline Design — The Ten Most Impactful Practices
actionlint runs in CI to catch pipeline syntax errors. A pipeline that is never reviewed accumulates security and reliability debt invisibly.The Compound Interest Analogy
Good CI/CD practices compound over time just like compound interest. A 5-minute reduction in PR pipeline duration, applied across a team of 10 developers making 5 PRs per day, saves 250 minutes of developer waiting time per day — 1,250 minutes per week. A flaky test eliminated today is not just one fewer false alarm; it is one fewer false alarm on every pipeline run for the life of the codebase. Investment in pipeline quality pays dividends continuously and without additional effort — which is why teams that prioritise it early consistently outperform teams that treat it as infrastructure debt to address later.
Testing, Security, and Deployment Practices
Beyond pipeline structure, three domains contain the most commonly violated practices in real-world CI/CD implementations. Each domain has a small set of principles that, when consistently applied, prevent the majority of the problems teams encounter.
Testing Practices
Security Practices
permissions: contents: read at the workflow level. Override per job only for what that job specifically requires. The blast radius of a compromised step is bounded by the permissions of the job it runs in.run: blocks. Direct interpolation is a script injection vulnerability. Run actionlint to detect it automatically.Deployment Practices
kubectl rollout status, ECS service stable waits, and equivalent checks must follow every deployment command. A pipeline that reports success before the runtime confirms health is providing false assurance.Team Practices — The Human Layer
The best pipeline infrastructure in the world is ineffective without the team practices that make it part of daily work. These are the cultural and operational norms that distinguish teams where CI/CD genuinely accelerates delivery from teams where CI/CD is a box-ticking exercise.
Team Practices That Make CI/CD Work in Practice
run: step in a workflow file has the same security implications as new application code. A pipeline reviewer who only checks syntax is not doing a meaningful review. Read the logic, check the permissions, verify the secrets usage.Warning: Best Practices Applied Selectively Produce False Confidence
The most dangerous CI/CD state is one that looks mature but has critical gaps. A team can have excellent test parallelisation but no flaky test policy — and wonder why developers bypass the pipeline. They can have comprehensive security scanning but skip it for hotfixes — and create the precise deployment pattern an attacker would exploit. They can use OIDC for some pipelines and long-lived keys for others — and have the keys leaked from the legacy pipeline. Best practices only deliver their full value when applied consistently. A policy that applies "except in emergencies" or "except for this service" is a policy with a gap. Emergencies and legacy services are exactly where gaps become incidents.
Key Takeaways from This Lesson
Teacher's Note
Pick the three practices from this lesson that your current pipeline violates most significantly and implement them this sprint — not all eighteen, just three. Focused improvement compounds faster than broad shallow adoption.
Practice Questions
Answer in your own words — then check against the expected answer.
1. What is the principle that states a single artifact is produced per commit and promoted through every environment without being rebuilt — ensuring that the artifact tested on staging is byte-for-byte identical to what reaches production?
2. What static analysis tool — recommended as a CI step for workflow files — catches pipeline syntax errors, type mismatches, missing required inputs, and script injection vulnerabilities in GitHub Actions YAML before they reach the main branch?
3. What are the timestamped events that pipelines should emit to observability platforms on every successful deployment — enabling engineers to immediately correlate metric changes with the specific deployment that caused them?
Lesson Quiz
1. A pipeline runs unit tests (4 min), integration tests (6 min), and security scans (3 min) sequentially, totalling 13 minutes. All three are independent. What single architectural change reduces this to approximately 6 minutes?
2. A team has a policy of running full security scans on all deployments, but bypasses them for hotfixes under time pressure. A security incident later reveals the hotfix deployment path was the vector. What principle does this illustrate?
3. A team lead wants to shift the team's culture toward treating CI/CD as a core engineering discipline rather than an infrastructure concern owned by one person. What single practice most effectively creates shared ownership of delivery performance?
Up Next · Lesson 39
CI/CD Anti-Patterns
Best practices are the positive case. Anti-patterns are the negative — the recurring mistakes that undermine CI/CD systems despite good intentions. Knowing them by name is the first step to avoiding them.