Git and CI/CD

Introduction

Continuous Integration (CI) runs tests and builds on every push or Pull Request—Git is the trigger. GitHub Actions, GitLab CI, and similar tools watch your repository and fail merges when quality checks break. This chapter maps Git events to pipelines and connects hello_code stacks (Maven, Gradle, Node) to protected branches.

Prerequisites

Git Events That Trigger CI

Event	Typical CI job
Push to feature branch	Test + lint
Open / update PR	Test on merge preview
Push to `main`	Test + build + deploy staging
Push tag `v*`	Release build + publish artifacts

Code explanation:

CI reads same commits you push—no separate upload step for source

Minimal GitHub Actions Example

.github/workflows/ci.yml:

yaml

Code explanation:

on.pull_request runs for PRs targeting main
checkout clones repo at event commit SHA

Stack-Specific Commands

Project	CI test command
Node / npm	`npm ci` && `npm test`
Maven	`./mvnw -B test` or `mvn test`
Gradle	`./gradlew test`

See Maven, Gradle, and Nginx deploy chapters for full pipelines.

Branch Protection

GitHub Settings → Branches → Add rule for main:

Require pull request before merging
Require status checks to pass (select CI job name)
Optional: require review approval
Block force pushes

Result: green CI + review before code lands on main.

PR Workflow With CI

text

Developer                    GitHub
    │  push feature branch      │
    ├──────────────────────────►│  CI runs on branch
    │  open PR                  │
    ├──────────────────────────►│  CI runs on PR merge ref
    │  fix test, push           │
    ├──────────────────────────►│  CI re-runs
    │  merge when green         │
    └──────────────────────────►│  CI on main (deploy optional)

Fix failing CI on same branch—do not merge with red checks unless emergency process exists.

Release Pipeline on Tags

yaml

on:
  push:
    tags:
      - "v*"
jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm run build
      - uses: softprops/action-gh-release@v2

Pairs with Tags and Releases—tag push builds shipping artifact.

Secrets in CI

Store tokens in GitHub Secrets / GitLab CI variables—never in repo:

yaml

env:
  NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

Rotate if leaked; audit who can edit workflows.

FAQ

CI fails only on PR?

Often missing env vars or different Node/Java version—match local .nvmrc / toolchain file.

Skip CI for docs?

Path filters in workflow paths:—advanced; some teams run full CI always.

Fork PR secrets?

Platforms restrict secrets on fork PRs—use maintainer approval workflows.

Self-hosted runners?

Same Git triggers; runner machine must trust repo access.

Merge queue?

GitHub merges PR into temporary branch, runs CI, then lands on main—reduces breakages.

CI vs local hooks?

Hooks = fast feedback; CI = authoritative for team.