Building CI Pipelines

# CHAPTER 6

Building CI Pipelines #

1. Introduction #

2. Learning Objectives #

• Define the "Build Phase" of a CI/CD pipeline.

• Use the actions/setup-* marketplace actions to configure programming languages.

• Execute package managers (like composer or npm) within a workflow.

• Understand how to structure a pipeline to "Fail Fast" on syntax errors.

• Construct a functional CI pipeline for a web application.

3. Beginner-Friendly Explanation #

• Checkout: The robot opens the Lego box and dumps the pieces on the table. (Chapter 5).

• The Build Phase: The robot realizes it's missing the wheels. It calls the Lego factory and orders the exact wheels needed. (Downloading dependencies). Once the wheels arrive, the robot snaps all the pieces together according to the instruction manual. (Compiling the code). If a piece doesn't fit, the robot stops immediately and says "Build Failed!"

4. Setting Up the Environment (actions/setup-*) #

Best Practice: Always explicitly declare the exact version of the language your app requires. GitHub provides official actions for this:

• actions/setup-node@v4

• shivammathur/setup-php@v2 (The industry standard for PHP in GitHub Actions)

• actions/setup-python@v5

5. Installing Dependencies #

• PHP uses composer.

• JavaScript uses npm.

6. Mini Project: Build CI Pipeline for a PHP Application #

Step-by-Step Walkthrough:

1. 1. Create .github/workflows/ci-pipeline.yml.

1. 2. Paste the following declarative code:

name: PHP CI Pipeline
on:
  pull_request:
    branches: [ "main" ]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      # Step 1: Open the Lego Box
      - name: Checkout Code
        uses: actions/checkout@v4

      # Step 2: Set up the specific tools we need
      - name: Setup PHP 8.2
        uses: shivammathur/setup-php@v2
        with:
          php-version: '8.2'
          extensions: mbstring, xml, ctype, iconv # Common PHP extensions
          coverage: none

      # Step 3: Order the missing pieces
      - name: Install Dependencies
        run: composer install --prefer-dist --no-progress

      # Step 4: Snap the pieces together (Syntax Check)
      - name: Lint PHP files
        run: find . -name "*.php" -print0 | xargs -0 -n1 php -l

7. Real-World Scenarios #

8. Best Practices #

• Fail Fast (Linting First): In the mini-project, Step 4 is a "Linter" (a syntax checker). It takes 2 seconds to run. Always run your fastest checks first. If a developer forgot a semicolon, the pipeline fails instantly, saving 10 minutes of cloud compute time that would have been wasted running heavy, slow integration tests.

9. Security Recommendations #

• Supply Chain Security: When you run npm install or composer install in your pipeline, you are downloading code from the internet and executing it on your server. If a malicious actor hacks an open-source library you depend on, your pipeline could be compromised. Always use lock files (e.g., composer.lock or package-lock.json) and run security audit commands (like npm audit) inside your pipeline.

10. Troubleshooting Tips #

• Composer/NPM Errors: If your dependency installation step fails with a network timeout, it's often a temporary issue with the package registry (like Packagist or npmjs.com), not your code. Try re-running the failed job in the GitHub UI before changing your workflow YAML.

11. Exercises #

1. 1. Why is it dangerous to omit the setup-* step and rely on the default software installed on the ubuntu-latest runner?

1. 2. What is the purpose of the "Linting" step in a Continuous Integration pipeline?

12. FAQs #

13. Interview Questions #

• Q: Explain the concept of "Dependency Hell" and how explicit environment setup steps (like actions/setup-node) mitigate this risk in a CI/CD pipeline.

• Q: A developer commits a change where they accidentally missed a closing bracket } in a core application file. Walk through how the CI pipeline designed in this chapter detects and handles this error.

14. Summary #

15. Next Chapter Recommendation #