Automate quality gates so that no change reaches production without passing tests, lint, type checking, and build. CI/CD is the enforcement mechanism for every other skill — it catches what humans and agents miss, and it does so consistently on every single change.
\nShift Left: Catch problems as early in the pipeline as possible. A bug caught in linting costs minutes; the same bug caught in production costs hours. Move checks upstream — static analysis before tests, tests before staging, staging before production.
\nFaster is Safer: Smaller batches and more frequent releases reduce risk, not increase it. A deployment with 3 changes is easier to debug than one with 30. Frequent releases build confidence in the release process itself.
\nEvery change goes through these gates before merge:
\nPull Request Opened\n │\n ▼\n┌─────────────────┐\n│ LINT CHECK │ eslint, prettier\n│ ↓ pass │\n│ TYPE CHECK │ tsc --noEmit\n│ ↓ pass │\n│ UNIT TESTS │ jest/vitest\n│ ↓ pass │\n│ BUILD │ npm run build\n│ ↓ pass │\n│ INTEGRATION │ API/DB tests\n│ ↓ pass │\n│ E2E (optional) │ Playwright/Cypress\n│ ↓ pass │\n│ SECURITY AUDIT │ npm audit\n│ ↓ pass │\n│ BUNDLE SIZE │ bundlesize check\n└─────────────────┘\n │\n ▼\n Ready for review\nNo gate can be skipped. If lint fails, fix lint — don't disable the rule. If a test fails, fix the code — don't skip the test.
\n# .github/workflows/ci.yml\nname: CI\n\non:\n pull_request:\n branches: [main]\n push:\n branches: [main]\n\njobs:\n quality:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v4\n\n - uses: actions/setup-node@v4\n with:\n node-version: '22'\n cache: 'npm'\n\n - name: Install dependencies\n run: npm ci\n\n - name: Lint\n run: npm run lint\n\n - name: Type check\n run: npx tsc --noEmit\n\n - name: Test\n run: npm test -- --coverage\n\n - name: Build\n run: npm run build\n\n - name: Security audit\n run: npm audit --audit-level=high\n integration:\n runs-on: ubuntu-latest\n services:\n postgres:\n image: postgres:16\n env:\n POSTGRES_DB: testdb\n POSTGRES_USER: ci_user\n POSTGRES_PASSWORD: ${{ secrets.CI_DB_PASSWORD }}\n ports:\n - 5432:5432\n options: >-\n --health-cmd pg_isready\n --health-interval 10s\n --health-timeout 5s\n --health-retries 5\n\n steps:\n - uses: actions/checkout@v4\n - uses: actions/setup-node@v4\n with:\n node-version: '22'\n cache: 'npm'\n - run: npm ci\n - name: Run migrations\n run: npx prisma migrate deploy\n env:\n DATABASE_URL: postgresql://ci_user:${{ secrets.CI_DB_PASSWORD }}@localhost:5432/testdb\n - name: Integration tests\n run: npm run test:integration\n env:\n DATABASE_URL: postgresql://ci_user:${{ secrets.CI_DB_PASSWORD }}@localhost:5432/testdb\n\n\nNote: Even for CI-only test databases, use GitHub Secrets for credentials rather than hardcoding values. This builds good habits and prevents accidental reuse of test credentials in other contexts.
\n
e2e:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v4\n - uses: actions/setup-node@v4\n with:\n node-version: '22'\n cache: 'npm'\n - run: npm ci\n - name: Install Playwright\n run: npx playwright install --with-deps chromium\n - name: Build\n run: npm run build\n - name: Run E2E tests\n run: npx playwright test\n - uses: actions/upload-artifact@v4\n if: failure()\n with:\n name: playwright-report\n path: playwright-report/\nThe power of CI with AI agents is the feedback loop. When CI fails:
\nCI fails\n │\n ▼\nCopy the failure output\n │\n ▼\nFeed it to the agent:\n\"The CI pipeline failed with this error:\n[paste specific error]\nFix the issue and verify locally before pushing again.\"\n │\n ▼\nAgent fixes → pushes → CI runs again\nKey patterns:
\nLint failure → Agent runs `npm run lint --fix` and commits\nType error → Agent reads the error location and fixes the type\nTest failure → Agent follows debugging-and-error-recovery skill\nBuild error → Agent checks config and dependencies\nEvery PR gets a preview deployment for manual testing:
\n# Deploy preview on PR (Vercel/Netlify/etc.)\ndeploy-preview:\n runs-on: ubuntu-latest\n if: github.event_name == 'pull_request'\n steps:\n - uses: actions/checkout@v4\n - name: Deploy preview\n run: npx vercel --token=${{ secrets.VERCEL_TOKEN }}\nFeature flags decouple deployment from release. Deploy incomplete or risky features behind flags so you can:
\n// Simple feature flag pattern\nif (featureFlags.isEnabled('new-checkout-flow', { userId })) {\n return renderNewCheckout();\n}\nreturn renderLegacyCheckout();\nFlag lifecycle: Create → Enable for testing → Canary → Full rollout → Remove the flag and dead code. Flags that live forever become technical debt — set a cleanup date when you create them.
\nPR merged to main\n │\n ▼\n Staging deployment (auto)\n │ Manual verification\n ▼\n Production deployment (manual trigger or auto after staging)\n │\n ▼\n Monitor for errors (15-minute window)\n │\n ├── Errors detected → Rollback\n └── Clean → Done\nEvery deployment should be reversible:
\n# Manual rollback workflow\nname: Rollback\non:\n workflow_dispatch:\n inputs:\n version:\n description: 'Version to rollback to'\n required: true\n\njobs:\n rollback:\n runs-on: ubuntu-latest\n steps:\n - name: Rollback deployment\n run: |\n # Deploy the specified previous version\n npx vercel rollback ${{ inputs.version }}\n.env.example → Committed (template for developers)\n.env → NOT committed (local development)\n.env.test → Committed (test environment, no real secrets)\nCI secrets → Stored in GitHub Secrets / vault\nProduction secrets → Stored in deployment platform / vault\nCI should never have production secrets. Use separate secrets for CI testing.
\n# .github/dependabot.yml\nversion: 2\nupdates:\n - package-ecosystem: npm\n directory: /\n schedule:\n interval: weekly\n open-pull-requests-limit: 5\nDesignate someone responsible for keeping CI green. When the build breaks, the Build Cop's job is to fix or revert — not the person whose change caused the break. This prevents broken builds from accumulating while everyone assumes someone else will fix it.
\nWhen the pipeline exceeds 10 minutes, apply these strategies in order of impact:
\nSlow CI pipeline?\n├── Cache dependencies\n│ └── Use actions/cache or setup-node cache option for node_modules\n├── Run jobs in parallel\n│ └── Split lint, typecheck, test, build into separate parallel jobs\n├── Only run what changed\n│ └── Use path filters to skip unrelated jobs (e.g., skip e2e for docs-only PRs)\n├── Use matrix builds\n│ └── Shard test suites across multiple runners\n├── Optimize the test suite\n│ └── Remove slow tests from the critical path, run them on a schedule instead\n└── Use larger runners\n └── GitHub-hosted larger runners or self-hosted for CPU-heavy builds\nExample: caching and parallelism
\njobs:\n lint:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v4\n - uses: actions/setup-node@v4\n with: { node-version: '22', cache: 'npm' }\n - run: npm ci\n - run: npm run lint\n\n typecheck:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v4\n - uses: actions/setup-node@v4\n with: { node-version: '22', cache: 'npm' }\n - run: npm ci\n - run: npx tsc --noEmit\n\n test:\n runs-on: ubuntu-latest\n steps:\n - uses: actions/checkout@v4\n - uses: actions/setup-node@v4\n with: { node-version: '22', cache: 'npm' }\n - run: npm ci\n - run: npm test -- --coverage\n| Rationalization | \nReality | \n
|---|---|
| \"CI is too slow\" | \nOptimize the pipeline (see CI Optimization below), don't skip it. A 5-minute pipeline prevents hours of debugging. | \n
| \"This change is trivial, skip CI\" | \nTrivial changes break builds. CI is fast for trivial changes anyway. | \n
| \"The test is flaky, just re-run\" | \nFlaky tests mask real bugs and waste everyone's time. Fix the flakiness. | \n
| \"We'll add CI later\" | \nProjects without CI accumulate broken states. Set it up on day one. | \n
| \"Manual testing is enough\" | \nManual testing doesn't scale and isn't repeatable. Automate what you can. | \n
After setting up or modifying CI:
\n