Deploy on Sikkerhet.bouvet.no - For Security Champions in Bouvet

CI/CD

Mon, 01 Jan 0001 00:00:00 +0000

Continuous Integration and Continuous Delivery (CI/CD) are practices for automating the flow from code change to running solution. Pipelines provide a standardized process for building, verification, and rollout, and reduce the risk of manual errors.

The point of CI/CD is not just speed but control. Each run should be traceable, repeatable, and have clear stopping points before anything goes to production.

The CI/CD flow from code change to production. The same artefact travels the whole way, and the stopping point before production is deliberate: every run should be traceable, repeatable and approved before it reaches end users.

Principles for CI/CD

Safe CI/CD practice is built on a few simple foundational principles:

Building

Mon, 01 Jan 0001 00:00:00 +0000

Building is the step where source code becomes a deployable artifact. The goal is for the artifact to be reproducible, verifiable, and traceable back to a specific commit and pipeline run.

This article focuses on the building process itself. Overall pipeline management is described in CI/CD, and deployment to environments is described in Deployment.

Build environments and build agents

Build agents typically come in two main forms:

Cloud provider-managed agents
Self-hosted agents (in the cloud or on-premise)

Cloud provider-managed agents often provide lower operating costs and simpler maintenance. Self-hosted agents give you more control but full responsibility for hardening, patching, and access management.

Deploy

Mon, 01 Jan 0001 00:00:00 +0000

Deployment starts after the artifact has been built and verified. The main principle is that the same artifact is promoted across environments without rebuilding in between.

This article focuses on rollout to environments. Overall pipeline management is covered in CI/CD, and details about safe artifact production in Building.

Principles for safe deployment

To reduce operational and security risk, the deployment process should be built on: