#CI/CD

Articles about CI/CD — exploring patterns, best practices, and real-world implementations in production systems.

16 posts tagged with ci/cd. ← All posts

#A2A (14)#ADK (8)#AG-UI (6)#AI (9)#AI Agents (311)#AI Architecture (21)#AI Cost (10)#AI Cost Optimization (8)#AI Engineering (227)#AI Evaluation (9)#AI Gateway (8)#AI Governance (29)#AI Red Teaming (9)#AI Research (9)#AI Safety (8)#AI Security (29)#AI in Production (12)#AML (3)#API Design (10)#API Security (8)#APIs (56)#AWS (17)#Accounting (9)#Agent Skills (3)#Agentic AI (24)#Agentic Commerce (12)#Agentic RAG (8)#Agents (4)#Amazon Bedrock (8)#Analytics (3)#Architecture (40)#Audit (3)#Authentication (11)#Authorization (3)#Automation (8)#Azure (11)#Azure AI Foundry (9)#Backend Engineering (310)#Benchmarks (3)#Best Practices (3)#BigQuery (6)#Business Finance (8)#Business Strategy (55)#C (8)#CI/CD (16)#Caching (11)#Capital Markets (14)#Card Payments (12)#Cards (13)#Career (25)#Checkpointing (4)#Claude Code (8)#Cloud (5)#Cloud Architecture (3)#Cloud Native (10)#Code Review (8)#Collaboration (5)#Communication (9)#Compliance (52)#Computer Networking (9)#Computer Science (32)#Computer Vision (5)#Concurrency (39)#Consulting (3)#Containers (10)#Context Engineering (10)#Conversational AI (8)#Cost Optimisation (5)#Credit (14)#Credit Risk (14)#CrewAI (8)#Crypto (12)#Cryptocurrency (12)#Cryptography (8)#Custody (9)#DSPy (8)#Data (13)#Data Engineering (12)#Data Structures (9)#Databases (38)#Deployment (4)#Design Patterns (10)#DevOps (24)#DevSecOps (21)#Developer Experience (5)#Developer Tools (5)#Distributed Systems (95)#Documentation (3)#Edge AI (8)#Embeddings (17)#Emotional Intelligence (8)#Energy (8)#Engineering (11)#Engineering Culture (3)#Engineering Practices (16)#Error Handling (4)#Evaluation (58)#Event-Driven Architecture (8)#FREE-AI (8)#FX (5)#Feedback (4)#FinOps (23)#FinTech (6)#Financial AI (14)#Financial Systems (129)#Fine-Tuning (11)#Fintech (131)#Flutter (8)#Foreign Exchange (5)#Forward Deployed Engineer (16)#Forward Deployed Engineering (8)#Fraud (10)#Function Tools (5)#Functional Programming (3)#Fundraising (8)#GCP (5)#Gemma (4)#Generative AI (3)#Git (8)#Go (220)#Go-to-Market (8)#Google ADK (36)#Governance (59)#Granite (6)#GraphQL (3)#Growth (3)#Guardrails (33)#HIPAA (3)#HTTP (3)#Harness Engineering (8)#Hiring (8)#Hugging Face (8)#Human-in-the-Loop (9)#IBM watsonx (8)#Identity (11)#Integration (3)#Intellectual Property (8)#Interfaces (3)#JavaScript (8)#KYC (11)#KYC and AML (12)#Kafka (10)#Kubernetes (17)#LLM (5)#LLM Inference (8)#LLM Infrastructure (8)#LLM-as-Judge (3)#LLMs (170)#LangChain (8)#LangGraph (11)#Leadership (26)#Ledger (12)#Legal (8)#Lending (14)#Linux (9)#LlamaIndex (8)#Load Balancing (3)#MCP (22)#MLOps (32)#Machine Learning (49)#Marketing (16)#Markets (4)#Memory (15)#Memory Management (5)#Metrics (6)#Microservices (3)#Microsoft Agent Framework (150)#Middleware (6)#Migration (9)#Mixture of Experts (5)#Monitoring (3)#Multi-Agent (10)#Multi-Agent AI (14)#Multi-Agent Systems (73)#Multimodal (3)#Multimodal AI (8)#NIM (5)#NVIDIA (8)#Networking (3)#OAuth (3)#OWASP (7)#Observability (49)#On-Device AI (8)#Open Source (7)#OpenTelemetry (5)#Operating Systems (9)#Operations (10)#Opinion (6)#Orchestration (10)#Organizational Design (8)#Payment Rails (16)#Payments (54)#People (8)#Performance (48)#Personalization (9)#Platform Engineering (9)#PreSales (8)#Privacy (5)#Privacy Engineering (3)#Process (4)#Product (29)#Product Management (8)#Production (11)#Programming (10)#Programming Languages (48)#Prompt Engineering (74)#Prompt Injection (14)#Protocol Buffers (3)#Protocols (9)#Providers (4)#Pydantic AI (8)#Python (142)#Quality (3)#RAG (59)#RBI (3)#REST (5)#Rails (16)#Reasoning Models (8)#Recommender Systems (8)#Reconciliation (3)#RegTech (8)#Regulation (9)#Reliability (52)#Resilience (4)#Responsible AI (5)#Retrieval (3)#Risk (13)#Rust (32)#SLSA (3)#SRE (22)#Sales (9)#Scalability (3)#Security (91)#Security Engineering (8)#Self-Evolving Agents (16)#Sessions (3)#Settlement (9)#Soft Skills (8)#Software (3)#Software Architecture (36)#Software Delivery (9)#Software Engineering (144)#Spanner (4)#Speech (8)#Startups (30)#Strands (8)#Streaming (31)#Structured Output (4)#Supply Chain Security (9)#Sustainability (8)#System Design (32)#Systems Programming (56)#Testing (53)#Threat Modeling (3)#Tool Use (22)#Tooling (5)#Tools (3)#Trading (8)#Treasury (6)#Type System (3)#Type Systems (11)#TypeScript (8)#Vector Databases (22)#Vector Search (11)#Venture Capital (8)#Version Control (8)#Voice AI (9)#Web Development (6)#Workflows (14)#eBPF (8)#gRPC (13)#smolagents (8)
Pratik Dhanave · ·6 min read

Operating Pipelines and Measuring Delivery

A pipeline isn't a build-it-once artifact; it's a production system that needs operating. It degrades — tests get flaky, builds get slow, rollbacks get rusty — and if you can't measure your delivery, you can't improve it. This closing post is about keeping a pipeline healthy over time and using the DORA metrics to know whether your CI/CD is actually working.

A pipeline isn't a build-it-once artifact; it's a production system that needs operating. It degrades — tests get flaky, builds get slow, rollbacks get rusty — and if you can't measure your delivery, you can't improve it. This closing post covers keeping a pipeline healthy, fast recovery over rare failure, observability, and using the DORA metrics to know whether your CI/CD actually works.

#CI/CD#DevOps#SRE#DORA#Software Delivery#Observability#Testing
Pratik Dhanave · ·6 min read

Security in the Pipeline

The CI/CD pipeline is one of the most privileged systems in an engineering organization — it has access to source code, secrets, and the keys to production — which makes it a prime target. Worse, it can become the delivery mechanism for an attack: compromise the pipeline and you compromise everything it ships. This post is about securing the pipeline itself and building security into it, the heart of DevSecOps.

The CI/CD pipeline is one of the most privileged systems in an org — access to source, secrets, and the keys to production — which makes it a prime target and a potential delivery mechanism for an attack. This post secures the pipeline itself (least privilege, secrets, pinned deps) and builds security into it (SAST/SCA/DAST), plus supply-chain integrity: SBOM, signing, SLSA provenance.

#CI/CD#DevSecOps#Supply Chain Security#DevOps#Software Delivery
Pratik Dhanave · ·5 min read

Pipeline as Code

A pipeline is only trustworthy if it's defined the same way your application is: as version-controlled code, reviewed and reproducible. "Pipeline as code" turns the path to production from clicked-together settings in a web UI into a file in your repository — and that shift, from configuration to code, brings the whole discipline of software engineering to bear on how you ship software.

A pipeline is only trustworthy if it's defined the same way your application is: as version-controlled code, reviewed and reproducible. Pipeline as code turns the path to production from clicked-together settings in a web UI into a file in your repository — bringing the whole discipline of software engineering to bear on how you ship software. The declarative model and principles for doing it well.

#CI/CD#DevOps#GitHub Actions#Infrastructure as Code#Software Delivery
Pratik Dhanave · ·6 min read

Deployment Strategies

How you put new code into production is a design decision with real consequences for risk and downtime. Deploy it all at once and a bad release hits everyone; roll it out gradually and you can catch problems while they're small. Blue-green, canary, rolling, and feature flags are the core techniques — each trading complexity for safety in a different way. This post covers when and why to use each.

How you put new code into production is a design decision with real consequences for risk and downtime. Deploy it all at once and a bad release hits everyone; roll it out gradually and you catch problems while they're small. Blue-green, canary, rolling, and feature flags are the core techniques — each trading complexity for safety differently. When and why to use each.

#CI/CD#DevOps#Deployment#Feature Flags#Software Delivery
Pratik Dhanave · ·5 min read

Continuous Delivery vs. Continuous Deployment

The two D's in CD/CD get used interchangeably, but they name genuinely different practices with different risk profiles and different prerequisites. Getting the distinction right — and knowing which one your system is actually ready for — is the difference between a mature delivery pipeline and a dangerous one. This post draws the line clearly and covers what it takes to cross it.

The two D's in CD get used interchangeably, but they name genuinely different practices with different risk profiles and prerequisites. Continuous Delivery keeps a human approval before production; Continuous Deployment removes it. This post draws the line clearly, covers environment promotion, and helps you decide which your system is actually ready for.

#CI/CD#DevOps#Continuous Delivery#Software Delivery
Pratik Dhanave · ·5 min read

The Build and Test Stages

The build and test stages are the engine of a pipeline — the part that decides, on every change, whether it's safe to proceed. Get them fast and trustworthy and the whole pipeline flows; get them slow or flaky and the pipeline becomes something developers route around. This post is about designing tests and builds that give a fast, reliable verdict.

The build and test stages are the engine of a pipeline — the part that decides, on every change, whether it's safe to proceed. Get them fast and trustworthy and the pipeline flows; get them slow or flaky and it becomes something developers route around. This post covers the test pyramid, deterministic tests, fail-fast staging, build-once-promote, caching, and parallelism.

#CI/CD#Testing#DevOps#Automation#Software Delivery
Pratik Dhanave · ·5 min read

Continuous Integration in Depth

Continuous Integration is the least glamorous and most important half of CI/CD. It's also the most misunderstood — teams install a build server, call it "CI," and miss the actual practice, which is a discipline about how often you merge, not which tool runs your tests. This post is about the real thing: integrating small, integrating often, and keeping the mainline always green.

Continuous Integration is the least glamorous and most important half of CI/CD, and the most misunderstood — teams install a build server, call it CI, and miss the actual practice, which is a discipline about how often you merge, not which tool runs your tests. This post is the real thing: integrate small, integrate often, keep the mainline always green.

#CI/CD#DevOps#Continuous Integration#Testing#Software Delivery
Pratik Dhanave · ·6 min read

What CI/CD Is, and Why It Exists

CI/CD is one of those acronyms everyone uses and few can define precisely. Strip away the tooling and it's an answer to a simple, painful question: how do you take a change a developer just wrote and get it safely into users' hands, quickly and repeatedly, without fear? This opening post defines the terms from first principles and explains the problem they solve.

CI/CD is an answer to a simple, painful question: how do you take a change a developer just wrote and get it safely into users' hands, quickly and repeatedly, without fear? This opening post defines the terms from first principles — CI, Continuous Delivery vs Deployment, the pipeline — and explains the integration-hell and deployment-fear problems they were invented to kill.

#CI/CD#DevOps#Software Delivery#Automation
Pratik Dhanave · ·6 min read

CI/CD: The Deployment Pipeline

CI/CD is the assembly line of modern software — the automated path from a developer's commit to running production code. It's the practice that turned releases from rare, terrifying events into routine, boring ones, and "boring releases" is one of the highest compliments in software. It's also the first capability any platform provides.

CI/CD is the assembly line of modern software — the automated path from a developer's commit to running production code. It turned releases from rare, terrifying events into routine, boring ones, and 'boring releases' is one of the highest compliments in software.

#Platform Engineering#DevOps#CI/CD#Backend Engineering#SRE
Pratik Dhanave · ·6 min read

Claude Code in Production Workflows

Beyond the interactive terminal, Claude Code can run headless in scripts and CI — which unlocks automation, and raises the stakes on permissions, review, and trust.

The capstone: running Claude Code headless in scripts and CI (PR review, batch ops, scheduled jobs) — and the guardrails it demands: least privilege, sandboxing, gating the produced artifact with human review, and the series' layered recap.

#Claude Code#CI/CD#Automation#AI#AI Agents#Guardrails
Pratik Dhanave · ·12 min read

SAST, DAST, and Security Testing in CI

How the four families of automated security tests — static analysis, dynamic analysis, secret scanning, and instrumented runtime testing — fit together across a pipeline, and why tuning signal-to-noise matters more than adding scanners.

Automated security testing in the pipeline: SAST vs DAST vs IAST and their trade-offs, secret scanning (including git history), where each runs, and making findings actionable so false-positive fatigue doesn't get the scanner muted.

#DevSecOps#SAST#DAST#CI/CD#Security#Testing
Pratik Dhanave · ·14 min read

Evaluation and Quality Gates

Governance is only as real as your ability to measure it. This is the MEASURE function of an AI risk program made concrete — a versioned eval set, the metric families that matter for an LLM system, and a CI gate that fails the build when quality regresses instead of just logging a warning.

Governance enforced through evaluation — the Measure function made real: build a versioned eval set, pick the metric families (quality, faithfulness, safety, bias, PII, cost/latency), and turn eval into a CI quality gate that fails the build on regression.

#AI Governance#Evaluation#CI/CD#LLMs#Governance
Pratik Dhanave · ·13 min read

Agent Evaluation in CI: Regression Gating

How to wire agent evaluations into continuous integration in Go — running a slow, model-calling eval harness under `go test`, setting per-metric thresholds that fail the build on a regression, and living honestly with the fact that these gates are softer than unit tests.

How to wire agent evaluations into continuous integration in Go — running a slow, model-calling eval harness under `go test`, setting per-metric thresholds that fail the build on a regression, and living...

#AI Agents#Evaluation#Go#CI/CD#Backend Engineering#Testing
Pratik Dhanave · ·11 min read

What DevSecOps Is

The opening post of a DevSecOps series — how security stops being a gate at the end of delivery and becomes an automated, shared responsibility built into every stage of the pipeline.

The opener to a DevSecOps series: building security into the delivery lifecycle instead of bolting it on — shift-left (and shift-right), security as everyone's job, the CI/CD pipeline as the enforcement point, and the automated controls the series wires up.

#DevSecOps#Security#CI/CD#Automation
Pratik Dhanave · ·6 min read

Testing Agents Without a Model

The full pipeline should run in CI with zero API keys and zero network. A deterministic classifier is the test double that makes an agentic system testable.

Put the seam at the router: same interface, a deterministic classifier for tests. The whole orchestration, routing, gateway, human-in-the-loop, and checkpointing, runs in CI with zero API keys and zero network.

#Agentic AI#Testing#Engineering#CI/CD#Multi-Agent Systems#APIs
Pratik Dhanave · ·7 min read

An Eval Regression Gate in CI

Treat agent output quality like a test. A baseline file plus a gate that fails the build on regression turns "the agents got worse" into a red X.

Agent systems rot because nobody catches quality regressions until users do. A committed baseline plus a gate that fails the build turns the agents got worse into a red X and a reviewable diff in the pull request.

#Agentic AI#Evaluation#Testing#CI/CD

All posts on this site are written by Pratik Dhanave, an Agentic AI Architect with 7+ years building production distributed systems, multi-agent AI platforms, and cloud-native infrastructure. About the author → Each article includes working code, architecture diagrams, and references to the specific frameworks and standards discussed. Browse all posts or explore related topics using the tag cloud above.