Tech Due Diligence CQ-1: CI/CD Pipeline Maturity

Set up a fully automated CI/CD pipeline using a modern platform like GitHub Actions, GitLab CI, CircleCI, or Jenkins. Trigger it automatically on code pushes and pull requests, with no manual steps needed for standard deployments. Structure the pipeline in clear stages. First, run linting and static analysis to catch quality issues immediately. Second, run the full unit test suite. Third, build application artifacts (Docker images, compiled binaries, etc.). Fourth, run integration tests against a staging environment. Fifth, deploy to staging for acceptance testing. Sixth, deploy to production with automated health checks. Build in deployment safety mechanisms: blue-green deployments or rolling updates to minimise downtime, automated health checks that verify the new deployment works correctly, automatic rollback if health checks fail, feature flags for disabling new features without redeploying, and approval gates for production releases where appropriate. Track and optimise pipeline performance. Target under 10 minutes for CI and under 30 minutes for the full pipeline. Keep flaky test rate below 1%. Aim for daily or more frequent deployments for mature teams, deployment failure rate under 5%, and fast mean time to recovery after a failed deployment. Secure the pipeline itself. Use ephemeral build agents, manage secrets through a proper secrets management system (not plain text environment variables), sign build artifacts, enforce branch protection rules requiring CI passage before merging, and audit access to pipeline configuration. Version-control the pipeline configuration alongside application code and document the architecture including all stages, dependencies, and configuration decisions.