Setting Up CI/CD for Code Quality

Why Automate Code Quality?

Manual code reviews are essential, but they can't catch everything. Automated checks run consistently, never get tired, and provide instant feedback to developers.

1. Essential CI/CD Stages for Code Quality

2. GitHub Actions Example

Here's a complete GitHub Actions workflow for code quality:

name: Code Quality

on:
  pull_request:
    branches: [main, develop]
  push:
    branches: [main]

jobs:
  lint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm ci
      - run: npm run lint
      - run: npm run format:check

  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm ci
      - run: npm test -- --coverage
      - uses: codecov/codecov-action@v3
        with:
          files: ./coverage/coverage-final.json

  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

  code-review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: coderaptor/action@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          api-key: ${{ secrets.CODERAPTOR_API_KEY }}

3. GitLab CI Example

stages:
  - lint
  - test
  - security
  - review

lint:
  stage: lint
  image: node:20
  script:
    - npm ci
    - npm run lint
    - npm run format:check

test:
  stage: test
  image: node:20
  script:
    - npm ci
    - npm test -- --coverage
  coverage: '/Statements\s*:\s*(\d+\.\d+)%/'

security:
  stage: security
  image: snyk/snyk:node
  script:
    - snyk test --severity-threshold=high

code-review:
  stage: review
  image: coderaptor/cli:latest
  script:
    - coderaptor review --mode=ci
  only:
    - merge_requests

4. Set Quality Gates

Define minimum standards that must pass:

5. Optimize CI/CD Performance

Caching Dependencies

- uses: actions/cache@v3
  with:
    path: ~/.npm
    key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
    restore-keys: |
      ${{ runner.os }}-node-

Parallel Jobs

Run independent checks in parallel to save time:

• Linting can run parallel with tests
• Security scans can run parallel with code review
• Use matrix strategies for multi-platform testing

Only Run What Changed

on:
  pull_request:
    paths:
      - 'src/**'
      - 'tests/**'
      - 'package.json'

6. Fail Fast vs Fail Safe

7. Status Checks and Branch Protection

On GitHub, require status checks before merging:

1. Go to repository Settings → Branches
2. Add branch protection rule for main
3. Enable "Require status checks to pass before merging"
4. Select which checks are required:
   • ✅ lint
   • ✅ test
   • ✅ security
   • ✅ code-review
5. Enable "Require branches to be up to date before merging"

8. Notification Strategy

When to Notify

• Always notify: Build failures, security vulnerabilities
• Selective notify: Coverage drops, new code smells
• Never spam: Successful builds (unless first success after failures)

Where to Notify

• Slack/Discord for critical failures
• Email for security alerts
• PR comments for code quality issues
• Dashboard for trends and metrics

9. Measuring CI/CD Effectiveness

10. Common Pitfalls to Avoid

11. Advanced: Pre-commit Hooks

Catch issues before they even reach CI:

# .husky/pre-commit
#!/bin/sh
npm run lint-staged

# package.json
{
  "lint-staged": {
    "*.{js,ts,tsx}": [
      "eslint --fix",
      "prettier --write"
    ],
    "*.{json,md}": [
      "prettier --write"
    ]
  }
}

12. Cost Optimization

Reduce CI/CD Costs

• Use self-hosted runners for private repos (cheaper than cloud minutes)
• Cache aggressively to reduce build times
• Only run full test suite on main, subset on PRs
• Use smaller Docker images (alpine vs full ubuntu)
• Clean up old artifacts and logs regularly