Skip to main content

CI/CD pipeline standard

One pipeline shape for all RAPID repos, shipped as shared templates in the project scaffold. Directly remediates the "partial automated deployment" problem on the legacy estate: every product reaches production the same automated way.

The pipeline​

build → unit → static analysis → secrets scan → SCA → integration
      → artefact signing → ephemeral preview env → e2e → promote

Every stage is a gate condition, wired to the merge gate (per-PR) and Production Readiness (per-release).

Rules​

  • Trunk-based, short-lived branches (see Branching & commits) — agents make long-lived branches deadly; divergence compounds at machine speed.
  • Ephemeral preview environment per PR — seeded from synthetic data (never production PII), giving every change a real environment to run e2e against.
  • Artefact signing and provenance on every build (SLSA); the SBOM is produced here and travels with the release.
  • Rollback and feature-flag conventions are part of the pipeline, not an afterthought — a release you can't roll back isn't production-ready.
  • DORA instrumentation is built in — deployment frequency, lead time, change-failure rate and MTTR are emitted by the pipeline itself, not measured by hand. Feeds the metrics platform.

Standards referenced​

SLSA (supply-chain integrity), DORA (delivery metrics), trunk-based development. The pipeline is where several standards become concrete at once — treat changes to it as decisions worth an ADR.