Continuous Integration and Continuous Delivery are the engineering practices that separate teams who ship daily from teams who ship monthly. CI ensures every code change is automatically built and tested before it reaches the main branch. CD ensures that code on the main branch can be deployed to production at any time — and ideally, is deployed automatically when all quality gates pass. Together, they reduce the risk of each individual deployment by making deployments smaller, more frequent, and more automated.
Anatomy of a Production-Grade Pipeline
- Lint & type-check: Fast feedback — fail within 60 seconds on obvious errors. Blocks the rest of the pipeline if they fail.
- Unit tests: Run in parallel, must complete in under 3 minutes. Slow test suites are skipped; fast test suites are run on every commit.
- Build: Reproducible production build. Docker image tagged with the commit SHA for precise rollback capability.
- Integration tests: Run against a real database and dependent services spun up in the CI environment. Not mocked.
- Security scan: Dependency audit, SAST scanning (Semgrep, Snyk), Docker image vulnerability scan.
- Deploy to staging: Automatic on merge to main. Smoke tests run against staging after deployment.
- Deploy to production: Canary (10% traffic), monitor error rates for 10 minutes, then full rollout. Automated rollback if error rate spikes.
The Deployment Frequency Metric
DORA metrics (Deployment Frequency, Lead Time for Changes, Change Failure Rate, Mean Time to Recovery) are the industry standard for measuring DevOps performance. Elite teams deploy to production multiple times per day with a change failure rate under 5% and MTTR under 1 hour. These numbers are not aspirational — they're achievable with good CI/CD practices, feature flags for risk mitigation, comprehensive observability, and a culture where "revert first, investigate second" is the standard incident response protocol.