Testing & CI/CD Pipeline Standard

Standardized stages, quality gates & outcomes — not the tools. Technology-agnostic across every project.

SOURCE CODE Git · trunk-based VALIDATE Lint · Typecheck · Format BUILD Compile · Artifact UNIT TESTS Fast · no external I/O INTEGRATION DB · MQ · 3rd-party SECURITY SAST · Deps · Secrets DEPLOY Container · K8s · Env SMOKE TEST Health · core path API / E2E REGRESSION P0+P1 journeys PERFORMANCE Load · k6 · scheduled RELEASE Prod gate · canary · rollback G1 CI GATE · build + P0 100% G2 SECURITY GATE · 0 critical G3 REGRESSION GATE · P1 ≥ thr G4 RELEASE GATE · approval PR / MR · FAST FEEDBACK • Lint + typecheck • Unit tests • Build • Basic security • Target 5–10 min STAGING · FULL VERIFICATION • Integration tests • Security scan • Deploy to staging • Smoke tests • API regression + E2E • Non-blocking perf PRODUCTION · STRICT • P0 re-run + approval • Canary deploy • Prod smoke + monitoring • Rollback ready ENVIRONMENTS LOCAL Unit · debug · secrets via env DEVELOPMENT Deploy · smoke · P0 · branch envs STAGING Full suite · E2E · perf · pre-prod PRODUCTION P0 · approval · canary · monitor Stages are enabled per project via central config — not every project runs every stage (maturity L1 → L4) Legend Quality / Validate Build / Deploy Test stages Security / Gates Performance Source / Release Quality gate Context boundary

Quality Gates

  • • G1 CI Gate — build, typecheck, P0 tests 100%
  • • G2 Security Gate — 0 critical vulnerabilities
  • • G3 Regression Gate — smoke 100%, P1 ≥ threshold
  • • G4 Release Gate — approval + monitoring

P0 / P1 / P2 Priorities

  • • P0 critical — login, payment, core flow · must pass before deploy
  • • P1 major — CRUD, validation, normal flows · must pass before release
  • • P2 minor — edge cases · nightly regression, non-blocking

Pipeline Contexts

  • • PR/MR — lint, typecheck, unit, build · 5–10 min feedback
  • • Staging — full suite, security, deploy, API + E2E regression
  • • Production — P0 re-run, approval, canary, rollback ready