---
id: wiki-2026-0508-ci-cd-pipeline
title: CI CD Pipeline
category: 10_Wiki/Topics
status: verified
canonical_id: self
aliases: [Continuous Integration / Delivery Pipeline, Build Pipeline]
duplicate_of: none
source_trust_level: A
confidence_score: 0.9
verification_status: applied
tags: [ci, cd, devops, pipeline]
raw_sources: []
last_reinforced: 2026-05-10
github_commit: applied
tech_stack:
  language: YAML
  framework: GitHub Actions/GitLab CI/Buildkite
---

# CI CD Pipeline

## 매 한 줄
> **"매 commit 이 production 까지 도달하는 자동 경로가 CI/CD pipeline."**. Pipeline 은 build → test → security → package → deploy → verify 의 매 ordered DAG. 2026 의 표준: GitHub Actions reusable workflow + OIDC 기반 cloud auth + supply-chain attestation (SLSA L3) + progressive delivery (Argo Rollouts/Flagger).

## 매 핵심

### 매 Pipeline Stage
1. **Source**: trigger on PR / push / tag.
2. **Build**: deterministic, hermetic — Bazel/Nx cache.
3. **Test**: unit / integration / e2e — parallel shards.
4. **Security**: SAST (Semgrep), SCA (Trivy), secret scan.
5. **Package**: container, helm chart, npm — sign (cosign).
6. **Attest**: SBOM (Syft) + SLSA provenance.
7. **Deploy**: env-progressive (dev → staging → prod).
8. **Verify**: smoke, canary metrics, auto-rollback.

### 매 Modern Best Practices 2026
- **OIDC over long-lived secrets** (GitHub OIDC → AWS/GCP).
- **Reusable workflows** — DRY across repos.
- **Matrix sharding** — test parallelism.
- **Cache layers** — Turborepo, Nx, Bazel remote cache.
- **Progressive delivery** — canary, blue/green, feature flags.
- **GitOps** — Argo CD / Flux — git as source of truth.
- **Supply chain** — Sigstore cosign, SLSA L3 attestation.

### 매 응용
1. SaaS web app deploy.
2. Library publish (npm, PyPI, Maven).
3. Container image release.
4. Mobile (Fastlane).
5. ML model deploy (MLOps).

## 💻 패턴

### GitHub Actions reusable workflow
```yaml
# .github/workflows/ci.yml
on: [pull_request, push]
permissions:
  contents: read
  id-token: write   # 매 OIDC
jobs:
  test:
    uses: org/.github/.github/workflows/ts-ci.yml@v1
    with:
      node-version: '22'
  deploy:
    needs: test
    if: github.ref == 'refs/heads/main'
    uses: org/.github/.github/workflows/deploy.yml@v1
    with:
      env: prod
```

### OIDC to AWS (no long-lived keys)
```yaml
- uses: aws-actions/configure-aws-credentials@v4
  with:
    role-to-assume: arn:aws:iam::123:role/gha-deployer
    aws-region: us-east-1
- run: aws s3 sync ./dist s3://my-bucket
```

### Matrix test sharding
```yaml
strategy:
  matrix:
    shard: [1, 2, 3, 4]
steps:
  - run: bun run vitest run --shard=${{ matrix.shard }}/4
```

### Container build + sign + SBOM
```yaml
- uses: docker/build-push-action@v6
  id: build
  with: { tags: ghcr.io/org/app:${{ github.sha }}, push: true }
- uses: anchore/sbom-action@v0
  with: { image: ghcr.io/org/app:${{ github.sha }}, format: spdx-json }
- uses: sigstore/cosign-installer@v3
- run: cosign sign --yes ghcr.io/org/app@${{ steps.build.outputs.digest }}
```

### Argo Rollouts canary
```yaml
apiVersion: argoproj.io/v1alpha1
kind: Rollout
spec:
  strategy:
    canary:
      steps:
        - setWeight: 10
        - pause: { duration: 5m }
        - analysis: { templates: [{ templateName: error-rate }] }
        - setWeight: 50
        - pause: { duration: 10m }
        - setWeight: 100
```

### Turborepo remote cache
```bash
# 매 first build seeds cache; later runs hit
TURBO_TOKEN=$REMOTE_TOKEN TURBO_TEAM=acme bunx turbo run build --remote-cache-timeout=60
```

## 매 결정 기준
| 상황 | Tool |
|---|---|
| OSS / GitHub repo | GitHub Actions |
| GitLab native | GitLab CI |
| Monorepo many pipelines | Buildkite / Dagger |
| K8s GitOps | Argo CD + Argo Rollouts |
| Multi-cloud workflow | Dagger / Earthly |

**기본값**: 매 GitHub Actions + OIDC + reusable workflow + Argo Rollouts.

## 🔗 Graph
- 부모: [[Continuous Integration (지속적 통합, CI)]] · [[Continuous Delivery (지속적 제공, CD)]]
- 변형: [[지속적 통합 (CI) 및 지속적 배포 (CD)]]
- 응용: [[Engineering Metrics (DORA)]] · [[Feature-Flags]]
- Adjacent: [[Husky]] · [[Test_Automation]] · [[Secret_Management]]

## 🤖 LLM 활용
**언제**: workflow YAML drafting, failed-build log triage, retry-storm root-cause.
**언제 X**: 매 deterministic step (lint/test) — pipeline 자체가 검증.

## ❌ 안티패턴
- **Long-lived AWS keys in secret**: 매 OIDC 사용.
- **`if: always()` 남용**: 매 fail 무시 — 신뢰 무너짐.
- **No cache**: 매 매 build 30분.
- **Single-stage everything**: 매 fail-fast 설계 안 됨.
- **No staging**: 매 직접 prod — rollback 어려움.

## 🧪 검증 / 중복
- Verified: GitHub Actions docs; SLSA spec v1.0; Argo Rollouts docs; DORA report 2024.
- 신뢰도 A.

## 🕓 Changelog
| 날짜 | 변경 |
|---|---|
| 2026-05-08 | Phase 1 |
| 2026-05-10 | Manual cleanup — pipeline stages + OIDC/SLSA/canary |