Skip to content
sec/atlas
back to the map
practice
stage: source → prod
2 min read

CI/CD

The backbone of modern software: every commit becomes a build, a test run and a deploy with no manual intervention.

GitHub ActionsGitLab CIJenkinsAzure DevOps

What it is

(CI) is the practice of automatically validating every code change: on each push or pull request, the pipeline compiles the project and runs the tests. The goal is to find out in minutes, not weeks, that a change broke something.

Continuous Delivery/Deployment (CD) extends the pipeline all the way: the validated artifact is packaged and published. In continuous delivery, deploying to production still requires a human click; in , everything that passes the gates goes live on its own.

Anatomy of a pipeline

Names vary between tools, but almost every pipeline follows the same backbone:

  • source: a push or PR triggers the pipeline from the repository
  • build: compiles, installs dependencies and resolves what the code needs
  • test: unit tests, integration tests and security checks
  • package: produces the final artifact: binary, package or
  • deploy: publishes to staging and, afterwards, to production
  • monitor: observability, alerts and a rollback path

The pipeline as code

Abstraction turns into clarity when you see the pipeline written out: the workflow below is a real GitHub Actions pipeline, with the trigger (source), build, tests and a security check running as just another step.

.github/workflows/ci.ymlyaml
name: ci
on: [push, pull_request]        # source stage: what triggers it
jobs:
  ci:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci                # build: reproducible install
      - run: npm test              # test: the test suite
      - run: npx semgrep ci        # security enters as just another step
      - run: docker build -t app . # package: produces the artifact

Why it is the center of security

Each stage is a gate where a security check can come in: and at build, in staging, at source. This is what exploits.

The reverse also holds: whoever controls the pipeline controls what goes to production. The SolarWinds attack (2020) compromised exactly the build system: the pipeline became the malware's distribution vector. The pipeline is critical infrastructure.

CIcontinuous integrationMerging small changes into a shared branch often, with every change built and tested automatically so integration problems appear within minutes.see in glossary →CDcontinuous delivery · continuous deploymentDelivery keeps every change deployable at any time; deployment goes further and releases each passing change to production automatically.see in glossary →Container imageA read-only stack of layers plus metadata from which containers start. Identified by a digest, tagged by a mutable name.see in glossary →SASTStatic analysis: examines the code without running it. It finds issues through flow analysis, not guesswork.see in glossary →SCAComposition analysis: inventories third-party dependencies and cross-references them with known CVEs.see in glossary →DASTDynamic testing: attacks the running application from the outside, as a black box.see in glossary →Secrets scanningScanning for exposed credentials in code, commits and git history.see in glossary →DevSecOpsSecurity as code inside CI/CD, with automated gates and shared responsibility.see in glossary →

connections on the map

updated on 14/10/2026 · sources to go deeper · report an error

in other domains

Unlocks

test what you learned

Loading questions…