Delivery
Continuous integration and the software supply chain
Fast, trustworthy pipelines - build, test, artifact, scan and sign - plus DORA metrics and supply-chain controls that keep trunk green.
Every commit is a bet that the main branch still works. Continuous integration (CI) is the automated system that settles that bet in minutes. It lints, tests, builds an artifact, scans it, signs it and publishes it, so that deployment has something trustworthy to ship.
CI is more than a workflow file copied from another project. It has latency budgets, failure modes and attackers. Two goals matter most. The first is fast feedback, ideally under about ten minutes for the default path. The second is trust: deterministic builds, pinned dependencies and signed artifacts.
Three properties separate a pipeline people trust from one they work around.
- Fast feedback. A 45-minute pipeline makes people batch commits and merge blind.
- Deterministic builds. The same commit should produce the same artifact. Floating tags and unpinned versions break that.
- Trunk-based development. Short-lived branches, frequent merges to
main, and feature flags for unfinished work.
Concept
Continuous integration means changes merge into a shared trunk often enough that integration failures are cheap to find. The CI tools (GitHub Actions, Buildkite, Jenkins) automate the checks. The practice is the merge cadence and a green trunk.
The concept pages
| Step | Concept | What it answers |
|---|---|---|
| 1 | Pipeline stages and caching | How do you order and speed up the default path? |
| 2 | Monorepos and affected builds | How do you avoid rebuilding everything on every commit? |
| 3 | Flaky tests | What do you do with a test that passes and fails at random? |
| 4 | Supply-chain security | How do you trust what the pipeline built? |
| 5 | DORA metrics | How do you measure whether delivery is getting better? |
GitHub Actions features
The platform adds a few features that matter for the pipeline's design.
- Runners run the jobs. GitHub-hosted runners are patched for you. Self-hosted runners reach private networks, but a compromised one is a production-grade risk.
- Reusable workflows keep org standards in one file. Centralise scanning and signing there, so product teams cannot forget them.
- Environments gate deploys with required reviewers and environment-scoped secrets. Use them for production, not for every unit test run.
- Concurrency groups cancel superseded runs on the same branch, so a push train does not burn the quota.
Common mistakes
- A 40-minute serial pipeline with no cache. People stop waiting for it.
- "Retry until green." Failures are hidden, and the signal goes away.
- Long-lived cloud keys in repository secrets. Use short-lived credentials instead.
- Floating
latesttags in production deploys. The deployed bytes can change without a commit. - Scanners that only warn. A scanner that never fails the build changes nothing.
Key takeaways
- CI buys fast feedback and a trustworthy trunk. Aim for about ten minutes on the default path.
- Pin dependencies and builds, so the same commit gives the same artifact.
- Stage the checks from cheap to expensive, and cache by lockfile.
- Sign artifacts and prefer short-lived credentials over stored keys.
- Track the four DORA metrics next to your error budgets.
Further learning
GitHub Actions documentation covers workflows, runners, environments and reusable workflows in full.
SLSA: Supply-chain Levels for Software Artifacts describes the graduated levels of build provenance.
Next, see how the default path is ordered and cached: pipeline stages and caching.
Related
Deployment strategies and safe releases
Rolling, blue-green and canary deploys, automated rollback, and zero-downtime schema changes - ship often without betting the fleet on every commit.
Testing strategy
What to test, at which level, and how to keep a suite fast, reliable, and worth the maintenance — from pyramid trade-offs to production safety nets.
Git internals and workflow
Git as a content-addressed object store plus a graph of commits and movable pointers, so merges, rebases, bisects and recoveries stop feeling risky, along with the team workflows that go with them.