High-quality CI/CD: quality gates, rollback, and safer releases

CI/CD is not just automatic deployment#

A professional pipeline is a sequence of controls. It shows which changes are allowed to move forward, which artifact is being released, what risks remain, and how rollback works if production fails.

Quality gates#

Useful gates include lint, type checking, unit tests, integration tests, production builds, dependency audits, and secret scanning. Fast gates should run on pull requests; expensive gates can run on schedules or before release.

Immutable artifacts#

Build once and promote the same artifact across environments. Use commit SHAs, build numbers, or semantic versions so production can be traced back to source and review history.

IMAGE_TAG=$(git rev-parse --short HEAD)
docker build -t registry.example.com/app:$IMAGE_TAG .
docker push registry.example.com/app:$IMAGE_TAG

Rollback and migrations#

Application rollback is usually easier than database rollback. Design risky migrations as multi-step releases: add schema, deploy compatible code, backfill, switch behavior, then remove old schema later.

Release checklist#

• Pull requests are small and describe risk and testing.
• CI passes lint, type checks, tests, and production build.
• Artifacts are tagged by commit or release version.
• Migrations are backward-compatible or have a recovery plan.
• Deployment has health checks and timeouts.
• Dashboards show error rate, latency, throughput, and logs.
• Rollback commands or procedures are written before release.

Primary references#

• GitHub Docs: GitHub Actions
• Kubernetes Docs: Deployments
• Docker Docs: Multi-stage builds