|
| 1 | +# CI/CD Pipeline Best Practices ⚙️ |
| 2 | + |
| 3 | +This document outlines the best practices for our CI/CD pipeline to ensure consistent, reliable, and efficient builds. |
| 4 | + |
| 5 | +## Overview 🌎 |
| 6 | + |
| 7 | +The primary goal of our CI/CD pipeline is to automate the process of building, testing, and deploying our application. Adhering to these guidelines is crucial for maintaining a stable and predictable development workflow. |
| 8 | + |
| 9 | +## Key Principles 🔑 |
| 10 | + |
| 11 | +- **Consistency:** Every build should be consistent, regardless of who triggers it or when. |
| 12 | +- **Reproducibility:** We must be able to reproduce any build at any time. This is critical for debugging and for ensuring that what we test is what we deploy. |
| 13 | +- **Speed:** A fast pipeline means faster feedback for developers. |
| 14 | + |
| 15 | +## Dependency Management 🖇️ |
| 16 | + |
| 17 | +Proper dependency management is the foundation of a reliable CI/CD pipeline. |
| 18 | + |
| 19 | +### The Role of `package.json` and `package-lock.json` 📦 |
| 20 | + |
| 21 | +- **`package.json`**: Lists the dependencies your project needs, often with a version range (e.g., `^1.2.3`). This file describes the _intended_ dependencies. |
| 22 | +- **`package-lock.json`**: Records the _exact_ version of every dependency that was installed, including sub-dependencies. This file ensures that you get the same dependency tree every single time. **This file must be committed to the repository.** |
| 23 | + |
| 24 | +### `npm install` vs. `npm ci` |
| 25 | + |
| 26 | +This is the most important distinction for our workflow. |
| 27 | + |
| 28 | +- **`npm install`**: |
| 29 | + - Use this command for **local development when you need to add or update dependencies**. |
| 30 | + - It may update your `package-lock.json` file based on the version ranges in `package.json`. |
| 31 | + - **NEVER use `npm install` (without arguments) in the CI/CD pipeline.** |
| 32 | + |
| 33 | +- **`npm ci`** ("Clean Install"): |
| 34 | + - This is the **ONLY command that should be used to install dependencies in the CI/CD pipeline**. |
| 35 | + - It installs dependencies directly from `package-lock.json`, ignoring `package.json`. |
| 36 | + - It guarantees reproducible builds because it always installs the exact same dependency versions. |
| 37 | + - It's generally faster than `npm install`. |
| 38 | + - It starts by deleting the `node_modules` directory to ensure a clean installation. |
| 39 | + |
| 40 | +## Workflow for Managing Dependencies |
| 41 | + |
| 42 | +### Local Development Workflow |
| 43 | + |
| 44 | +1. **To add a new dependency:** |
| 45 | + |
| 46 | + ```bash |
| 47 | + npm install <package-name> |
| 48 | + ``` |
| 49 | + |
| 50 | + For a development dependency (e.g., a testing library): |
| 51 | + |
| 52 | + ```bash |
| 53 | + npm install <package-name> --save-dev |
| 54 | + ``` |
| 55 | + |
| 56 | +2.**Commit changes:** After adding or updating dependencies, commit both the `package.json` and the updated ``package-lock.json` files. |
| 57 | + |
| 58 | +```bash |
| 59 | +git add package.json package-lock.json |
| 60 | +git commit -m "feat: Add <package-name> dependency" |
| 61 | +``` |
| 62 | + |
| 63 | +### CI/CD Pipeline Workflow |
| 64 | + |
| 65 | +1.**Checkout code:** The pipeline will check out the latest version of the code from the repository. |
| 66 | + |
| 67 | +2.**Install dependencies:** The pipeline must use `npm ci` to install dependencies. |
| 68 | + |
| 69 | +```yaml |
| 70 | +# Example step in a GitHub Actions workflow |
| 71 | +- name: Install Dependencies |
| 72 | + run: npm ci |
| 73 | +``` |
| 74 | +
|
| 75 | +This ensures that the pipeline uses the exact dependency versions that you tested with locally. |
| 76 | +
|
| 77 | +## Best Practices Summary |
| 78 | +
|
| 79 | +- **Always** commit your `package-lock.json` file. |
| 80 | +- **Always** use `npm ci` in the CI/CD pipeline to install dependencies. |
| 81 | +- **Only** use `npm install <package-name>` locally to add or update dependencies. |
| 82 | +- **Regularly** update your dependencies locally to get the latest features and security patches, and commit the updated `package-lock.json`. |
| 83 | +- Ensure your `package.json` and `package-lock.json` files are in sync before pushing your changes. `npm ci` will fail if they are not, which is a good thing. |
0 commit comments