Workflows, Orbs, Workspaces & Secrets

Fan-Out / Fan-In

workflows:
  ci:
    jobs:
      - build
      - lint:
          requires: [build]
      - unit-tests:
          requires: [build]
      - integration-tests:
          requires: [build]
      - deploy:
          requires: [lint, unit-tests, integration-tests]  # fan-in
          type: approval  # pause for manual sign-off before this runs

lint/unit-tests/integration-tests fan out in parallel after build; deploy fans back in, requiring all three to pass first. Adding type: approval turns deploy into a manual gate requiring a human click in the UI.

Orbs

version: 2.1
orbs:
  node: circleci/node@5

jobs:
  build:
    executor: node/default
    steps:
      - checkout
      - node/install-packages   # reusable command from the orb, no need to hand-roll caching

Workspaces vs. Cache

A workspace passes files between jobs WITHIN one pipeline run (this run's exact build output). A cache persists data ACROSS separate runs (dependencies that rarely change). Using cache for a build artifact would be wrong — it's specific to this commit, not safe to reuse later.

jobs:
  build:
    steps:
      - run: npm run build
      - persist_to_workspace:
          root: .
          paths: [dist]
  deploy:
    steps:
      - attach_workspace:
          at: .
      - run: ./deploy.sh dist/

Contexts (Shared Secrets)

Contexts securely share environment variables (API keys, deploy credentials) across projects at the org level, with access control — avoiding duplicating the same secret into every project's own settings.

Artifacts

store_artifacts uploads files (coverage reports, failed-test screenshots) so they're downloadable from the pipeline UI afterward — valuable for debugging a failure without re-running the whole pipeline.