What Is CI/CD? Automated Deployment Explained for AI Coders

Why AI Coders Need CI/CD

Manual deployment is a trap. You write code, you SSH into your server, you run a list of commands you half-remember, something fails, you troubleshoot, your site is down for 20 minutes. This gets worse every time you add a teammate or increase deployment frequency.

CI/CD solves this by making deployment a single action: git push. Everything else is automated. Understanding CI/CD lets you:

• Ship faster with less anxiety about breaking things
• Catch bugs before they reach production (the "CI" part)
• Never forget a deployment step (the "CD" part)
• Work on teams without deployment conflicts
• Read job descriptions and client requirements that mention CI/CD without confusion

Real Scenario: Deploy on Every Push

What AI Generated

# .github/workflows/deploy.yml
# Place this file in your repo at: .github/workflows/deploy.yml

name: Deploy to Production

# Trigger: run this workflow when code is pushed to 'main'
on:
  push:
    branches: [main]

jobs:
  test-and-deploy:
    runs-on: ubuntu-latest  # GitHub runs this on a fresh Ubuntu VM

    steps:
      # Step 1: Download your code onto the runner
      - name: Checkout code
        uses: actions/checkout@v4

      # Step 2: Install Node.js
      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '22'
          cache: 'npm'

      # Step 3: Install dependencies
      - name: Install dependencies
        run: npm ci  # 'ci' is like 'install' but stricter (uses package-lock.json)

      # Step 4: Run tests — workflow stops here if tests fail
      - name: Run tests
        run: npm test

      # Step 5: Deploy to VPS via SSH (only runs if tests passed)
      - name: Deploy to VPS
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.VPS_HOST }}       # Stored in GitHub Secrets
          username: ${{ secrets.VPS_USER }}   # Never hardcode these!
          key: ${{ secrets.VPS_SSH_KEY }}     # The private SSH key
          script: |
            cd /var/www/myapp
            git pull origin main
            npm ci --production
            pm2 restart myapp  # Restart the Node.js process

For Vercel (Even Simpler)

# No workflow file needed!
# Connect your GitHub repo to Vercel:
# 1. Go to vercel.com → New Project
# 2. Import your GitHub repository
# 3. Done — Vercel automatically deploys on every push to main

# Vercel handles: build → test → deploy → HTTPS → CDN
# This is what most AI coders should start with

Understanding the Pipeline

The Three Stages

Developer pushes code to GitHub
         ↓
┌─────────────────────────────────┐
│  CONTINUOUS INTEGRATION (CI)    │
│  • Checkout fresh copy of code  │
│  • Install dependencies         │
│  • Run automated tests          │
│  • Run linter / type checks     │
│  • Build the app                │
│  → If anything fails: STOP.     │
│    Send error notification.     │
└─────────────────────────────────┘
         ↓ (only if CI passed)
┌─────────────────────────────────┐
│  CONTINUOUS DEPLOYMENT (CD)     │
│  • Upload built app to server   │
│  • Restart the app process      │
│  • Run health check             │
│  • Send success notification    │
└─────────────────────────────────┘
         ↓
App is live in production

GitHub Actions: How It Works

GitHub Actions runs your workflow on runners — fresh virtual machines GitHub provides. Each time a workflow triggers, GitHub spins up a clean Ubuntu/Windows/macOS VM, runs your steps, and discards it. You pay nothing for the compute on public repos; private repos get 2,000 free minutes/month.

The workflow file lives in your repository at .github/workflows/anything.yml. YAML format. AI generates these well — but watch out for the secrets issue below.

Secrets: The Critical Part AI Gets Wrong

Your deployment workflow needs credentials: server IP, SSH keys, API tokens. These must never be in the YAML file. They go in GitHub Secrets:

# In your GitHub repo: Settings → Secrets and variables → Actions → New secret

# Add:
# VPS_HOST     = 203.0.113.42
# VPS_USER     = deploy
# VPS_SSH_KEY  = (paste your private key)
# DATABASE_URL = postgresql://...

# Reference in workflow:
${{ secrets.VPS_HOST }}     # GitHub substitutes the real value at runtime
${{ secrets.DATABASE_URL }}  # Never appears in logs

# ✅ Safe — secret is encrypted at rest and masked in logs
# ❌ NEVER do this:
# host: 203.0.113.42          # Hardcoded — visible to everyone with repo access

CI/CD for Different Hosting Setups

Vercel / Netlify: Zero Config

Connect your repo. Done. Every push to main deploys automatically. Preview deployments on pull requests. This is the easiest CI/CD for most vibe coders and covers 90% of use cases.

Railway / Render: Also Automatic

Connect repo, configure your build command and start command. Automatic deployments on push. Slightly more control than Vercel for backend/database apps.

VPS: GitHub Actions Required

Manual hosting requires a workflow file. The pattern: test → SSH into server → git pull → restart process. See the workflow above.

Docker + Any Host

name: Build and Deploy Docker Image

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build Docker image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Push to registry
        run: |
          echo ${{ secrets.REGISTRY_TOKEN }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
          docker push ghcr.io/${{ github.repository }}/myapp:${{ github.sha }}

      - name: Deploy on VPS
        uses: appleboy/ssh-action@v1
        with:
          host: ${{ secrets.VPS_HOST }}
          username: ${{ secrets.VPS_USER }}
          key: ${{ secrets.VPS_SSH_KEY }}
          script: |
            docker pull ghcr.io/${{ github.repository }}/myapp:${{ github.sha }}
            docker stop myapp || true
            docker run -d --name myapp -p 3000:3000 ghcr.io/${{ github.repository }}/myapp:${{ github.sha }}

What AI Gets Wrong About CI/CD

1. Hardcoding Secrets

Critical. AI sometimes generates workflow files with actual values instead of secret references. Never commit passwords, API keys, or SSH keys to a repository file — even private repos.

2. Missing Health Checks

AI deploys the app but doesn't verify it started correctly. Add a health check after deployment:

- name: Health check
  run: |
    sleep 10  # Wait for app to start
    curl --fail https://yourdomain.com/api/health || exit 1
    # If /api/health returns non-200, the workflow fails and you get notified

3. Deploying on Every Push (Including Feature Branches)

AI sometimes generates workflows that trigger on pushes to any branch. Usually you only want to deploy when pushing to main:

on:
  push:
    branches: [main]  # Only deploy from main — not feature branches

What to Learn Next

Frequently Asked Questions