{
  "uid": "cogitave.learn.ci-cd-pipelines.the-ci-pipeline",
  "kind": "moduleUnit",
  "href": "/modules/ci-cd-pipelines/the-ci-pipeline/",
  "title": "The CI pipeline",
  "summary": "",
  "type": null,
  "products": [],
  "roles": [],
  "levels": [],
  "subjects": [],
  "headings": [
    "The canonical stage set",
    "Why CI is the real gate",
    "Repos wire workflows, they do not fork them"
  ],
  "source": "Every repository runs the **same ordered stage set** on every pull request and\non every push to `main`. The stages are **fail-fast**: a failed mandatory gate\nstops the pipeline and blocks the merge. Read this as a pipeline you can trace,\nnot a black box.\n\n## The canonical stage set\n\nThe\n[CI/CD pipelines standard](../../../../standards/docs/standards/ci-cd-pipelines.md)\ndefines the ordered stages. In order, they run: checkout and pinned toolchain;\nlockfile-honest install and cache; format check; lint; build; unit tests;\nintegration tests; the coverage gate; optional mutation testing; then the\nsecurity band - secret scan (gitleaks), SAST, SCA and license, SBOM and\nprovenance; then IaC scan, container scan, and artifact build and sign where the\nproject ships those surfaces; contract and E2E where a public contract exists;\n`docs-required`; and, for control-plane and docs repos, estate-lint and\nfact-drift.\n\nYou do not need every number in your head. You need the shape and the floor.\n\n> [!IMPORTANT]\n> The **mandatory floor on every pull request, for all project types**, is:\n> checkout and toolchain, resolve and cache, format check, lint, build, unit\n> tests, the coverage gate, the secret scan, SAST, SCA and license, and\n> `docs-required`. Everything else is conditional on project type and risk\n> class.\n\nThe stages that prove test quality (coverage, mutation) are owned by the\ntesting-quality standard; the security band (secret scan through sign) is owned\nby the supply-chain standard. The pipeline standard does **not** restate their\nnumbers - it only mandates that each gate **runs and blocks**. When you need a\nthreshold, follow the pipeline to the owning standard rather than guessing.\n\n## Why CI is the real gate\n\nYour editor and the local hook run the same targets - the standard calls this\n`lefthook == just == CI` parity, so a fast format-and-lint pass runs before you\npush. That local run is a **mirror, not the gate**. ADR 0017 states it plainly:\n**CI is the real gate; local hooks are only the fast mirror.** A hook can be\nskipped, run on a stale tree, or differ from a teammate's machine. CI runs the\ncanonical, pinned stage set on the actual merge candidate, and its result is\nrecorded evidence.\n\nCI is also the **machine half of the Definition of Done**. The request lifecycle\nadvances a change toward `done` only when the machine gates are green *and* a\nhuman reviewer (a CODEOWNER) approves - the human half, separation of duties.\nThe pipeline supplies the evidence for the machine items: tests green, coverage\nmet, `docs-required` satisfied, no secrets, no new high or critical\nvulnerabilities.\n\n## Repos wire workflows, they do not fork them\n\nStage logic lives in **one** place: the org reusable workflows. A repository does\nnot hand-roll stage logic; it **calls** a reusable workflow and passes inputs\n(the language, a coverage minimum, an environment). Two rules make this\nauditable: every `uses:` is pinned to a full commit SHA, and every workflow\ndeclares the **minimum** permissions - default `contents: read`, with write\nscopes granted only to the one job that needs them. A change to a gate is then\none reviewed pull request for the whole estate, not a drift-prone edit in each\nrepo.\n",
  "partOf": "cogitave.learn.ci-cd-pipelines",
  "durationInMinutes": 7,
  "quiz": null
}