How do you overcome the challenges or risks of CI/CD, such as security, testing, or deployment issues?

While many organisations claim the successful deployment of CI/CD, the majority turnout to be BI/BD which is Broken Integration and Broken Deployment due to poor or no maintenance in reality check! It is not the output that matters but the outcome of CI/CD!

One thing I found useful is called 'Just in Time' from Japanese Management Principle fit into CI/CD which is not just a bunch of tools introduced by DevOps engineers, but a matured culture that produce clean and sustainable software when built,integrated and deployed with right Devops implementation using tools such as ecoCode,Battery Historian, Linting Scans such as Axe-Lint!

Unit tests can be incorporated into the deployment process, such that they are run before any automated deployment is made with the new code. Code reviews among the development team can provide feedback to each developer and challenge them on why they used this feature or that component, so as to ensure that resources are used efficiently and objects are properly disposed in order to avoid memory leaks. These are always challenges in any CI/CD environment because these things cannot be found through an automated testing process, but can be caught by skillful peers simply reading the code.

One of the most important aspects of successful CI/CD pipelines, is to consider security early in the process. To be successful and safe in this deployment approach security implications must be incorporated into the development cycle rather than considered as a must do at the end. One example is code scanning... There are many competent vendor products for code scanning. That said, many development efforts don't incorporate security measures until right before deploy, resulting in re-work and delays.

For organizations with traditional QA testing code after it has been done, it can be challenging to shift the mindset to involve QA earlier in the process. It can seem counter-intuitive for QA to be working with developers while solutions are being designed and code is being written, but using the strength and knowledge of QA early will result in higher quality code. Additionally, when testers contribute to test cases earlier, building out the required coverage of test cases becomes easier.

In my experience, we always needed a code review stage by PRs, Unit testing, Approvals and in some cases rollback strategies for damage control. Again it’s case by case and mere happy path CICD is great way to start and an enterprise feedback loop in designing the pipelines, environment, branching, and deployment strategy worked out really well.