Pipeline Anatomy

Stages, gates, environments

A pipeline is not just 'a script that runs on push'. It is a directed graph of stages, separated by gates, ending at one or more environments.

The classic anatomy:

Source — checkout. The exact commit being processed.
Build — compile, bundle, containerize. Output is an artifact — a deterministic, named, immutable thing.
Test — unit, integration, acceptance. Often parallelized.
Static analysis — lint, type-check, security scan, license scan.
Package — assemble the artifact for deploy (Docker image, npm tarball, wheel).
Deploy → staging — usually automatic.
Acceptance / smoke tests against staging.
Deploy → production — Delivery: gated by approval. Deployment: automatic.
Post-deploy verification — smoke tests against prod, observability checks.

Not every project needs every stage. A static site can collapse build/package/deploy into one. A regulated bank app might add 5 more (compliance scan, change advisory board approval, audit log emission). The shape is always a graph of gates around an artifact.

Code

Two-environment pipeline (staging → production)·yaml

name: pipeline
on: { push: { branches: [main] } }
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: ./build.sh
      - uses: actions/upload-artifact@v4
        with: { name: dist, path: dist/ }

  test:
    needs: build
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: ./test.sh

  deploy-staging:
    needs: [build, test]
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - uses: actions/download-artifact@v4
        with: { name: dist }
      - run: ./deploy.sh staging

  deploy-prod:
    needs: deploy-staging
    runs-on: ubuntu-latest
    environment: production    # gated
    steps:
      - uses: actions/download-artifact@v4
        with: { name: dist }
      - run: ./deploy.sh prod

Stages, gates, environments

Code

External links

Exercise

Progress

Comments 0