MARKDOWNpipeline-design.md
Copy
1
# CI/CD Pipeline Design
2
 
3
## Pipeline Stages
4
 
5
```
6
Commit → Fast Checks → Build → Integration → Staging → [Approve] → Production
7
```
8
 
9
## Stage 1: Fast Checks (< 5 min, runs on every PR)
10
- **Lint**: ruff, eslint
11
- **Type check**: mypy, tsc
12
- **Unit tests**: pytest --co -q (no I/O, mocked)
13
- **Security**: bandit, npm audit
14
 
15
## Stage 2: Build & Scan (runs after merge to main)
16
- Build Docker image (multi-stage)
17
- Scan with Trivy for HIGH/CRITICAL CVEs
18
- Push to registry with SHA tag
19
- Generate SBOM
20
 
21
## Stage 3: Integration Tests (10–20 min)
22
- Spin up docker-compose environment
23
- Run API integration tests
24
- Run contract tests (Pact)
25
- Tear down
26
 
27
## Stage 4: Staging Deploy (auto on main)
28
- Deploy same image to staging (no rebuild)
29
- Run smoke tests (5 critical paths)
30
- Load test (k6, 100 VU, 5 min)
31
- Gate: smoke tests must pass
32
 
33
## Stage 5: Production Deploy (manual approval)
34
- Approval required from release team
35
- Deploy with canary (10% → 50% → 100%)
36
- Monitor error rate for 15 min per stage
37
- Automatic rollback if error_rate > 1%
38
 
39
## Rollback Strategy
40
1. kubectl rollout undo (< 2 min)
41
2. Feature flag disable (< 30 sec for flag-guarded features)
42
3. Database: migration rollback script (if schema changed)
43
 
44
## Key Metrics
45
- DORA Lead Time for Changes: < 24h target
46
- Deployment Frequency: multiple per day
47
- Change Failure Rate: < 5%
48
- MTTR: < 1h
49