CI/CD Pipeline Best Practices: Modern DevOps 2026

# Good commit messages
git commit -m "Add user authentication flow"

git commit -m "Fix: Resolve null pointer in user service
- Add null check before processing
- Add unit test for edge case
- Update documentation"

# Conventional commits
git commit -m "feat: add password reset functionality"
git commit -m "fix: resolve memory leak in cache"
git commit -m "docs: update API documentation"

# .github/workflows/ci.yml
name: CI

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v4
    
    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: '20'
        cache: 'npm'
    
    - name: Install dependencies
      run: npm ci
    
    - name: Run linter
      run: npm run lint
    
    - name: Run tests
      run: npm test
    
    - name: Build
      run: npm run build

- name: Run unit tests
  run: npm test -- --coverage

- name: Run integration tests
  run: npm run test:integration
  services:
    postgres:
      image: postgres:15
      env:
        POSTGRES_PASSWORD: test
      options: >-
        --health-cmd pg_isready
        --health-interval 10s
        --health-timeout 5s
        --health-retries 5

- name: E2E Tests
  run: npm run test:e2e
  env:
    BASE_URL: ${{ secrets.STAGING_URL }}

- name: Deploy to blue
  run: kubectl apply -f blue-deployment.yaml

- name: Run smoke tests
  run: ./smoke-tests.sh blue

- name: Switch traffic
  run: kubectl patch service -p '{"selector":{"version":"blue"}}'

- name: Deploy canary (10%)
  run: kubectl apply -f canary-deployment.yaml

- name: Monitor metrics
  run: ./monitor.sh

- name: Promote if healthy
  run: kubectl scale deployment app --replicas=10

- name: Rolling update
  run: kubectl rollout status deployment/app

- name: Login to registry
  uses: docker/login-action@v3
  with:
    username: ${{ secrets.REGISTRY_USER }}
    password: ${{ secrets.REGISTRY_TOKEN }}

- name: Scan dependencies
  uses: snyk/actions/node@master
  env:
    SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

- name: Scan Docker image
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: 'myapp:${{ github.sha }}'

livenessProbe:
  httpGet:
    path: /health
    port: 8080
  initialDelaySeconds: 30
  periodSeconds: 10

readinessProbe:
  httpGet:
    path: /ready
    port: 8080
  initialDelaySeconds: 5
  periodSeconds: 5

- name: Rollback on failure
  if: failure()
  run: |
    kubectl rollout undo deployment/app
    echo "Deployment rolled back"

# GitOps workflow
workflow:
  1. Developer pushes code to Git
  2. CI pipeline builds and tests
  3. CD tool detects changes in Git
  4. Changes are automatically deployed
  5. Kubernetes cluster state matches Git

# application.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: my-app
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/myorg/my-app.git
    targetRevision: HEAD
    path: deploy
  destination:
    server: https://kubernetes.default.svc
    namespace: production
  syncPolicy:
    automated:
      prune: true
      selfHeal: true

# GitRepository
apiVersion: source.toolkit.fluxcd.io/v1
kind: GitRepository
metadata:
  name: my-app
  namespace: flux-system
spec:
  url: https://github.com/myorg/my-app
  ref:
    branch: main
---
# Kustomization
apiVersion: kustomize.toolkit.fluxcd.io/v1
kind: Kustomization
metadata:
  name: my-app
  namespace: flux-system
spec:
  sourceRef:
    kind: GitRepository
    name: my-app
  path: ./deploy
  prune: true
  selfHeal: true

// Feature flag with LaunchDarkly
const LaunchDarkly = require('launchdarkly-node-server-sdk');

const ldClient = LaunchDarkly.init(process.env.LD_KEY);

async function serveUser(userId) {
  const showNewFeature = await ldClient.boolVariation(
    'new-payment-flow',
    { key: userId },
    false
  );

  if (showNewFeature) {
    return renderNewPaymentFlow();
  }
  return renderLegacyPaymentFlow();
}

# GitHub Actions with feature flags
- name: Deploy canary
  run: |
    ldflags="-X main.featureEnabled=${{ steps.variation.value }}"
    go build -ldflags "$ldflags" -o myapp

# Canary deployment with Flagger
apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
  name: my-app
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: my-app
  service:
    port: 80
  analysis:
    interval: 1m
    threshold: 10
    maxWeight: 50
    stepWeight: 10
    metrics:
      - name: request-success-rate
        threshold: 99
        interval: 1m
      - name: request-duration
        threshold: 500
        interval: 1m

# GitHub Actions with contract testing
- name: Run contract tests
  run: |
    npm run test:contracts
  env:
    PACT_BROKER_URL: ${{ secrets.PACT_BROKER_URL }}
    PACT_BROKER_TOKEN: ${{ secrets.PACT_BROKER_TOKEN }}

- name: Publish contract
  run: |
    npm run publish:contracts

// Consumer test (Pact)
describe('Order API', () => {
  it('should accept valid orders', () => {
    return pact
      .addInteraction({
        given: 'the service accepts valid orders',
        willRespondWith: {
          status: 201,
          body: like({ orderId: '123' }),
        },
      })
      .executeTest((mockServer) => {
        return fetch(`${mockServer.url}/orders`, {
          method: 'POST',
          body: JSON.stringify({ product: 'Widget' }),
        });
      });
  });
});

# GitHub Actions with chaos testing
- name: Install LitmusChaos
  run: |
    kubectl apply -f https://litmuschaos.io/litmus-operator-v3.0.0.yaml

- name: Run pod kill chaos
  run: |
    kubectl apply -f - <<EOF
    apiVersion: litmuschaos.io/v1alpha1
    kind: ChaosEngine
    metadata:
      name: pod-kill-chaos
      namespace: default
    spec:
      appinfo:
        appns: default
        applabel: "app=myapp"
      chaosServiceAccount: litmus-admin
      experiments:
        - name: pod-delete
          spec:
            components:
              env:
                - name: TOTAL_CHAOS_DURATION
                  value: '30'
EOF

# .github/workflows/slsa.yml
name: SLSA Build
on: [push]

jobs:
  build:
    runs-on: ubuntu-latest
    outputs:
      digest: ${{ steps.build.outputs.digest }}
    steps:
      - uses: actions/checkout@v4
      
      - name: Build
        id: build
        run: |
          echo "::set-output name=digest::$(sha256sum myapp | cut -d' ' -f1)"
          go build -o myapp
      
      - name: Attest
        uses: slsa-framework/slsa-github-generator/actions/attest@v1
        with:
          subject: "myapp"
          digest: ${{ steps.build.outputs.digest }}
          predicate: predicate.json

- name: Generate SBOM
  uses: cyclonedx/cyclonedx-npm@v1
  with:
    output-file: sbom.json

- name: Upload SBOM
  uses: actions/upload-artifact@v3
  with:
    name: sbom
    path: sbom.json

- name: Calculate cost
  run: |
    # Estimate build cost
    BUILD_MINUTES=$((SECONDS / 60))
    COST=$(echo "$BUILD_MINUTES * 0.008" | bc)
    echo "Build cost: \$$COST"
    
    # Report to cloud watch
    aws cloudwatch put-metric-data \
      --metric-name BuildCost \
      --namespace CI/CD \
      --value $COST

# Multi-layer caching
- name: Cache Docker layers
  uses: actions/cache@v3
  with:
    path: /tmp/.docker-cache
    key: ${{ runner.os }}-docker-${{ hashFiles('Dockerfile') }}
    restore-keys: |
      ${{ runner.os }}-docker-

- name: Cache Go modules
  uses: actions/cache@v3
  with:
    path: ~/go/pkg/mod
    key: ${{ runner.os }}-go-${{ hashFiles('go.sum') }}
    restore-keys: |
      ${{ runner.os }}-go-

- name: Cache npm
  uses: actions/cache@v3
  with:
    path: ~/.npm
    key: ${{ runner.os }}-npm-${{ hashFiles('package-lock.json') }}