Ci Cd

Common Patterns

• Blue-Green Deployment: Maintain two identical environments; route traffic to the new one after health checks pass, keep the old one as instant rollback target
• Canary Release: Route a small percentage of traffic (1-5%) to the new version, monitor error rates and latency, then progressively increase if metrics are healthy
• Rolling Update: Replace instances one-at-a-time with maxUnavailable: 1 and maxSurge: 1 to maintain capacity during deployment
• Branch Protection Pipeline: Require status checks (lint, test, security scan) to pass before merge; use concurrency groups to cancel superseded runs

Pitfalls to Avoid

• Do not hardcode versions of CI runner images; pin to specific digests or semantic versions and update deliberately
• Do not skip security scanning steps to save time; integrate SAST/DAST as non-blocking checks initially, then make them blocking
• Do not use pull_request_target with checkout of PR head without understanding the security implications for secret exposure
• Do not allow pipeline definitions to drift between environments; use a single source of truth with environment-specific variables