loom-ci-cd

# CI/CD ## Overview Pipeline design, security hardening, and optimization across GitHub Actions, GitLab CI, Jenkins, CircleCI, and cloud-native platforms. The load-bearing content is **Expert Practices** (bottom) — supply-chain, least-privilege, OIDC, cache trust boundaries, and platform gotchas. Read that section for any non-trivial pipeline. ## Design Principles - **Fail fast, cheap-first**: lint → typecheck → unit → integration → build → deploy. A stage should only run if everything cheaper passed. - **Parallelize independent work**; shard slow test suites across runners; matrix multi-version/OS. - **Cache by lock-file hash, scoped by OS** — never by branch (see cache gotcha). Cache deps, build output, Docker layers. - **Build once, promote by digest** — never rebuild per environment (see Design Patterns). What you validated in staging must be the exact bytes that reach prod. - **Least privilege**: `permissions: {}` default, grant per-job; OIDC not stored cloud keys; pin actions by SHA. - **Every deploy reversible**; pipelines idempotent/re-runnable; manual approval gates for prod via environments. - **Shift security left**: SAST/secret/dependency scans early; container scan pre-push; block on CRITICAL/HIGH. ### Deployment strategies | Strategy | Mechanism | Rollback | Use when | | -------------- | -------------------------------------- | ------------------ | --------------------------------- | | R...