Design and Implement CI/CD Deployment Pipelines

This skill designs robust, secure deployment pipelines that balance speed with safety through proper stage organization and approval workflows. Its standard pipeline flow runs Build to Test to Staging to Approve to Production, broken into nine detailed stages: source checkout, build (compile/package/containerize), test (unit, integration, security scans), staging deploy, integration/E2E/smoke tests, a manual approval gate, production deploy (canary, blue-green, or rolling), post-deploy verification (health checks, monitoring), and automated rollback on failure. It covers three approval-gate patterns - manual approval via a GitHub Actions environment block, time-based delayed approval in GitLab CI, and multi-approver manual validation in Azure Pipelines - and four deployment strategies: rolling deployment (gradual, zero-downtime, easy rollback, best for most apps), blue-green (instant switchover via service label swap, doubled infrastructure cost, good for high-risk changes), canary (a weighted, paused traffic-shift rollout via Argo Rollouts, requires a service mesh or similar), and feature flags (deploy without releasing, A/B testing, instant rollback via a flag check like Flagsmith's has_feature).

Use it to design CI/CD architecture, implement deployment gates, configure multi-environment pipelines, establish deployment best practices, or implement progressive delivery. It does not apply outside deployment pipeline design - a different domain or tool is out of scope. It pairs with separate github-actions-templates and gitlab-ci-patterns skills for platform-specific implementation and a secrets-management skill for secrets handling.

Inputs: the application's build/test/deploy requirements and target environments. Outputs: a multi-stage pipeline definition (a GitHub Actions example chains build, test with a Trivy security scan, staging deploy, E2E integration tests, canary production deploy via Argo Rollouts promote, health-check verification, and a Slack notification), automated and manual rollback procedures (kubectl rollout undo, optionally to a specific revision, or an automated health-check-then-rollback step), and pipeline metrics to track - deployment frequency, lead time, change failure rate, MTTR, pipeline success rate, and average duration.

GitHub Actions, GitLab CI, and Azure Pipelines for gate patterns; Kubernetes (RollingUpdate strategy, kubectl rollout) and Argo Rollouts for canary/blue-green deployment; Trivy for image security scanning; Flagsmith for feature flags; Prometheus for post-deployment error-rate verification; and Vault-style secret stores referenced in its best practices.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  replicas: 10
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxSurge: 2
      maxUnavailable: 1

Platform and DevOps engineers designing CI/CD pipeline architecture who need staged approval gates and a deployment strategy - rolling, blue-green, canary, or feature-flagged - matched to their risk tolerance.