What It Actually Means
Continuous integration is automatically checking every change as it is made: running the tests, checking style, looking for known security problems in dependencies. If a check fails, the change does not proceed.
Continuous delivery or deployment is automatically taking changes that passed and putting them live, or making them ready to go live at the press of a button.
Together they form a pipeline: somebody makes a change, it is checked automatically, and it reaches customers without anyone performing a sequence of manual steps.
Why It Is Worth Paying For
The value is that the checks happen every time, without depending on anyone remembering.
Human process degrades under pressure. When something urgent needs to ship, the tests are the thing that gets skipped, and the urgent change is precisely the one most likely to have a mistake in it. A pipeline that refuses to deploy a failing change removes that decision from a tired person at a bad moment.
The second benefit is speed with safety, which usually trade against each other. Because checks are automatic and fast, changes can be small and frequent, and small frequent changes are easier to diagnose when something does go wrong.
What A Reasonable Pipeline Does
For an ordinary business system, the useful checks are not exotic.
Run the automated tests and stop if any fail. Check the code builds cleanly. Scan dependencies for known vulnerabilities, since most security problems arrive through libraries rather than through your own code. Apply consistent formatting automatically, so review is about substance rather than layout. Then deploy to a staging environment, and to production on approval.
That is achievable in a day or two of setup on any modern hosting, and the cost is close to nothing thereafter.
What To Ask
- Do we have a pipeline, and what does it check? If nothing automated runs before a deploy, that is the gap.
- Can a change reach production without passing the checks? There should be no route around it, including for urgent fixes.
- How long does the pipeline take? More than about ten minutes and people start finding ways around it.
- Is anything currently failing that has been ignored? Pipelines with a permanently red step have stopped being a check and become decoration.
- Are dependency vulnerabilities scanned automatically? Cheap, and it addresses the most common route in.
The Realistic View
This is infrastructure, so it never appears as a feature and it is often the first thing cut from a budget.
That is usually a false economy, because everything else moves at the speed the pipeline allows. Without one, every release carries manual effort and manual risk, and both are paid repeatedly, forever, out of the same budget that could have built something.
For a small system the honest answer is that a proportionate version is enough: run the tests, scan the dependencies, deploy automatically. The elaborate arrangements that large engineering organisations run are not the standard your project is being measured against, and a supplier who proposes one for a modest build is solving for their own comfort.
More terms are in the glossary.
