Continuous integration recap — the foundation and its limits

Continuous integration, as established in Part XXXVII, is automated execution against a commit. A CI pipeline watches a repository, checks out a commit on a runner, runs the commands the pipeline defines, and reports a pass or fail. That sentence is the whole of CI; everything that comes after - delivery, deployment, release - is built on top of that foundation and is not part of it.

What CI guarantees

A green CI run proves three things and only three things:

• The commit exists at the SHA the pipeline reports. The pipeline checked out a specific commit, and the result is reproducible against that commit.
• The pipeline ran to completion on a clean runner. The tests passed against the code that was checked out; no manual steps were skipped.
• The artifact, if any, was produced from that commit. A container image, a Terraform plan, a Helm chart, or a compiled binary is the verifiable output of a specific input.

That is the entire guarantee. Three things, all of them about the artifact and the run, none of them about whether the artifact should be applied to production.

What CI does not guarantee

A green CI run is silent on every question that matters for a production deploy:

• Whether the change is semantically correct. Tests verify what they verify. A test suite that does not exercise a code path cannot fail on that path.
• Whether the change has been reviewed. CI does not know what a reviewer knows. The pipeline runs regardless of who, if anyone, has approved the pull request.
• Whether the change is safe to apply to production. The pipeline tested against a test environment, with synthetic data, on a runner that is not the production cluster.
• Whether the change is desired at all. A perfectly green build of an unwanted feature is a green build that should not be deployed.

flowchart LR
    A[Commit] --> B[CI pipeline]
    B --> C{Tests pass?}
    C -- "no" --> D[Pipeline fails]
    C -- "yes" --> E[Artifact published]
    E --> F{Anything beyond CI?}
    F -- "delivery" --> G[Manual approval gate]
    F -- "deployment" --> H[Automatic production apply]
    G --> I[Production]
    H --> I[Production]

The diagram shows the boundary. CI ends at the artifact. Every question about what to do with the artifact - hold it, review it, apply it - sits outside CI.

CI is necessary but not sufficient

Both continuous delivery and continuous deployment require CI. Neither is implied by CI.

• Continuous delivery without CI is impossible. The artifact that the gate holds is the CI artifact. Without a pipeline that produces a reproducible artifact on every merge, there is nothing for the gate to hold.
• Continuous deployment without CI is impossible. The artifact that the workflow applies to production is the CI artifact. The workflow that applies it is itself a CI workflow. Removing CI from a continuous deployment setup collapses the entire practice.
• CI alone, however, is not delivery or deployment. A green pipeline that publishes an artifact nobody ever applies is a green pipeline; it is not delivery or deployment.

Production discipline

1. A green CI run is a precondition, not a conclusion. The run proves the artifact exists and the pipeline ran. It does not prove the artifact should be applied.
2. CI is the floor, not the ceiling. Teams that stop at CI have automation; they do not have delivery or deployment. The rest of this part is about what comes next.
3. The artifact is the unit of trust. Whatever CI publishes - image, plan, chart, binary - is what the delivery or deployment workflow consumes. A pipeline that does not produce an artifact is a pipeline that does not enable either CD term.
4. Test coverage is a CI discipline, not a CI guarantee. CI does not enforce that tests cover the change. A green build of untested code is a green build of an unverified claim.

Cross-course references

• This course, Part XXXVII (CIFundamentals) - lesson git-cicd-gitops-xxxvii-01-what-ci-is-and-is-not is the full treatment of what CI guarantees and does not guarantee.
• This course, Part L (TerraformCI) - lessons git-cicd-gitops-l-05-terratest-and-integration-tests and git-cicd-gitops-l-06-plan-as-artifact-and-pr-comment show CI applied to Terraform, including the plan-as-artifact pattern that continuous delivery workflows consume.
• This course, Part XLIV (Artifacts) - lesson git-cicd-gitops-xliv-01-what-an-artifact-is establishes the artifact as the durable output of CI.

Quiz