# CI/CD — Derived Rules

> Derives from `domains/devops/first-principles.md` P2 (Automation), P4 (Rollback First), P5 (Progressive Delivery).

## The Pipeline is the Process (P2)

- If it is not in the pipeline, it does not happen. Manual deploys are a bug.
- The pipeline: lint → test → build → deploy → verify.
- Every step is scripted, versioned, and reproducible. No "run this command on the server."

## Lint (P2, core C2 Clarity)

- Run the linter on every commit. Fail the build on lint errors.
- Format check (prettier, gofmt, rustfmt). Format is not a debate; it is automated.
- Security lint (eslint-plugin-security, bandit, gosec). Catch the obvious ones.

## Test (P2, domains/testing)

- Unit tests in the pipeline. Fast. Every commit.
- Integration tests on merge to main. Slower. Every merge.
- E2E tests before deploy. Slowest. Every deploy candidate.

## Build (P7 Immutability)

- Build once. The artifact is immutable. The same artifact goes to every environment.
- The build is reproducible: same commit → same artifact (modulo timestamps, which are stripped).
- Build artifacts are signed and stored. A deploy is a reference to an artifact, not a rebuild.

## Deploy (P4 Rollback First, P5 Progressive Delivery)

- Every deploy has a rollback. The rollback is tested before the deploy.
- Progressive: canary (1% → 10% → 100%), blue-green, or feature flags.
- No big-bang deploys. A big-bang deploy is a rollback with no rehearsal.

## Verify (P3 Observability)

- After deploy, verify: health checks, smoke tests, metric watching.
- A deploy is not "done" when the code is on the server. It is done when the metrics are healthy.
- Auto-rollback on metric regression. The pipeline watches; humans sleep.

## What Violates CI/CD Discipline

| Violation | Principle |
|-----------|-----------|
| Manual deploy script | P2 Automation |
| No rollback path | P4 Rollback First |
| Big-bang deploy to prod | P5 Progressive Delivery |
| Rebuild per environment | P7 Immutability |
| Deploy without health check | P3 Observability |
| No lint in CI | P2, C2 |