CI-CD Pipeline
CI/CD (Continuous Integration / Continuous Delivery or Deployment) pipeline is an automated process that helps developers build, test, and deploy software faster and more reliably.
Here is a typical step-by-step CI/CD pipeline flow:
Developer Code
↓
Source Control (Git/GitHub/Azure Repos)
↓
CI Pipeline (Build + Test)
↓
Artifact Creation
↓
Deploy to Dev Environment
↓
Deploy to Test/QA Environment
↓
Deploy to Stage/UAT Environment
↓
Deploy to Production
↓
Monitoring & Feedback
---
In CI/CD Pipeline -- Detailed
Typical flow:
++++++++++++++++++++++++++
1. Developer writes code
↓
2. Code Commit / Push to Repository (Git)
↓
3. Build Stage
- Compile code
- Resolve dependencies
↓
4. Static Code Analysis
- Code quality checks
- Security scans
- Coding standards validation
↓
5. Unit Testing
- Test individual components
↓
6. Build Artifact Creation
- Create package (JAR, WAR, Docker image, ZIP, etc.)
↓
7. Artifact Repository Storage
- Store artifacts (e.g., Nexus, Artifactory)
↓
8. Deploy to Development Environment
↓
9. Integration Testing
- Validate component interactions
↓
10. Deploy to Test / QA Environment
↓
11. Functional Testing
12. API Testing
13. Performance Testing (if applicable)
14. Security / Vulnerability Testing
↓
15. User Acceptance Testing (UAT)
↓
16. Deploy to Staging Environment
↓
17. Approval / Release Gate (Optional)
↓
18. Deploy to Production
↓
19. Smoke Test / Health Check
↓
20. Monitoring & Logging
↓
21. Feedback / Incident Monitoring
↓
22. Continuous Improvement → back to development
1. Developer Writes Code
├─ Develop feature / bug fix
├─ Local validation
└─ Local unit testing
↓
2. Code Commit / Push (Git)
├─ Push code to branch
├─ Pull Request / Merge Request
└─ Code review
↓
3. Build Stage
├─ Compile source code
├─ Download dependencies
├─ Build application
└─ Build verification
Testing:
✓ Build validation
✓ Compilation checks
✓ Dependency verification
↓
4. Static Code Analysis
├─ Code quality analysis
├─ Coding standards validation
├─ Security scan
├─ Duplicate code detection
└─ Complexity analysis
Testing:
✓ Static analysis
✓ Vulnerability scanning
✓ Maintainability checks
↓
5. Unit Testing
├─ Test individual methods
├─ Validate business logic
├─ Exception handling
└─ Coverage validation
Testing:
✓ Unit tests
✓ Code coverage
✓ Edge case validation
↓
6. Build Artifact Creation
├─ Create JAR / WAR
├─ Create Docker image
└─ Package deployment artifact
Testing:
✓ Artifact integrity verification
↓
7. Artifact Repository Storage
├─ Store build artifact
└─ Version management
Testing:
✓ Artifact checksum validation
↓
8. Deploy to DEV Environment
Testing in DEV:
✓ Integration Testing
- Service → Service validation
- API → Database validation
- External dependency validation
✓ Smoke Testing
- Application startup
- Login validation
- Basic API validation
✓ Deployment Validation
- Kubernetes deployment
- Configuration validation
↓
9. Deploy to TEST / QA Environment
Testing in QA:
✓ Functional Testing
- Feature validation
- Requirement validation
✓ API Testing
- Response validation
- Authentication validation
- Error handling
✓ Regression Testing
- Existing functionality checks
✓ Performance Testing
- Load testing
- Stress testing
- Endurance testing
✓ Security Testing
- Vulnerability scanning
- Authentication checks
- Authorization checks
✓ Compatibility Testing
- Browser validation
- Device validation
↓
10. Deploy to UAT Environment
Testing in UAT:
✓ User Acceptance Testing
- Business workflow validation
- End-to-end business scenarios
- Stakeholder approval
Outcome:
APPROVED → Move forward
REJECTED → Return to DEV
↓
11. Deploy to STAGING Environment
Testing in STAGING:
✓ Final Smoke Testing
✓ End-to-End Testing
✓ Deployment Validation
- Infrastructure validation
- Helm deployment validation
- Kubernetes health validation
✓ Release Validation
- Version verification
- Configuration verification
↓
12. Production Deployment
Testing in PROD:
✓ Smoke Test
- Critical API health
- Application availability
✓ Health Checks
- Database connectivity
- Pod health
- Service availability
✓ Monitoring
- CPU
- Memory
- Error rate
- Logs
✓ Incident Monitoring
- Alerts
- Failures
- Performance degradation
↓
13. Feedback & Continuous Improvement
└─ Production findings return to development
↓
Cycle repeats
++++++++++++++++++++++++++
1. Code Development
- Developer writes code.
- Code is committed to Git repository.
- Example:
2. Continuous Integration (CI)
Triggered automatically after code push.
CI activities:
- Pull latest code
- Compile/build application
- Run unit tests
- Static code analysis
- Security scans
- Create deployment artifact (Docker image, JAR, ZIP, Helm chart)
Purpose of Unit Testing
- Verify code behaves as expected
- Catch bugs early during development
- Make code changes safer
- Improve code quality and maintainability
Common Unit Testing Tools
-
Python →
pytest,unittest -
Java →
JUnit -
JavaScript →
Jest -
C# →
NUnit -
.NET →
xUnit
Static Code Analysis is the process of examining source code without running the program to identify issues such as bugs, security vulnerabilities, coding standard violations, and maintainability problems.
It analyzes the code statically (before execution).
What Static Code Analysis checks
- Code quality issues → duplicate code, complex methods
- Coding standard violations → naming conventions, formatting
- Potential bugs → null pointer risks, unused variables
- Security vulnerabilities → SQL injection risks, hardcoded secrets
- Performance concerns → inefficient code patterns
- Maintainability issues → overly complex logic
Common Static Code Analysis Tools
- Java → SonarQube, PMD, Checkstyle
- Python → Pylint, Flake8
- JavaScript → ESLint
- C# → StyleCop
- Multi-language → SonarQube
1. Static Application Security Testing (SAST)
Scans source code for security issues.
Finds:
-
SQL Injection risks : SQL Injection risks are the security dangers that happen when an attacker manipulates SQL queries through user input.
-
Hardcoded passwords
- Cross-Site Scripting (XSS) : Cross-Site Scripting (XSS) is a security vulnerability where an attacker injects malicious JavaScript code into a web page, and that code runs in other users’ browsers.
- Insecure coding patterns
Tools:
- SonarQube
- Checkmarx
- Fortify
- Semgrep
Example:
Integration Testing in DEV means:
Testing whether different modules/services of the application work together correctly after deployment.
Smoke Testing
Quick “sanity check” of application:
Checks:
“Does each feature work as per requirement?”
Tools used for Functional Testing
Tests full application flow:
Login → Search → Cart → Checkout → Payment → Confirmation
Regression Testing (Major here)
Ensures new changes didn’t break existing features:
✔ Old login still works
✔ Old API still works
✔ Previous features unaffected
Tools used for Regression testing
✔ Selenium (UI regression) ✔ Cypress (modern UI regression) ✔ TestNG / JUnit (test frameworks) ✔ Robot Framework ✔ Playwright
More deep testing than DEV:
Tools:
- JMeter
- LoadRunner
UAT (User Acceptance Testing) – What tools are used?
UAT = Business users testing the system to confirm it meets real business needs.
So tools here are usually not heavy automation tools (like DEV/QA), but more business-friendly tools.
1. 🔥 Final Smoke Testing (most important)
✔ App starts correctly
✔ Login works
✔ Core APIs respond
✔ No deployment issues
2. 🔁 End-to-End (E2E) Testing
Login → Browse → Add to Cart → Payment → Confirmation
Checks:
- Full real-world flow
- All integrations working together
1. feature/* branch
Purpose:
- Developer builds one feature
- Safe place to work without affecting others
↓
Push to feature branch
↓
CI Pipeline triggers automatically
↓
Build
↓
Static Code Analysis
↓
Unit Tests
↓
(Optional) Integration Tests
↓
PR created → develop branch
↓
PR validation pipeline runs again
↓
Reviewer approval
↓
Merge to develop
✓ Build again
✓ Static Analysis again
✓ Unit Tests again
✓ Security Scan
↓
Reviewer approves
↓
Merge to develop
↓
Merge → develop
↓
CI Pipeline triggers on develop
✓ Build
✓ Static Analysis (optional)
✓ Unit Tests
✓ Package Artifact
↓
CD Pipeline
Deploy → DEV
Comments
Post a Comment