Jon Chery
496303471d
---ci--- project: atelier phase: 7 milestone: v0.1 status: complete phase_role: final milestone_complete: true requirements: covered: [ATELIER-01, ATELIER-02, ATELIER-03, ATELIER-04, ATELIER-05, ATELIER-06, ATELIER-07, ATELIER-08, ATELIER-09, ATELIER-10, ATELIER-11, ATELIER-12, ATELIER-13, ATELIER-14, ATELIER-15, ATELIER-16, ATELIER-17, ATELIER-18, ATELIER-19, ATELIER-20, ATELIER-21, ATELIER-22, ATELIER-23, ATELIER-24, ATELIER-25, ATELIER-26, ATELIER-27, ATELIER-28, ATELIER-29, ATELIER-30, ATELIER-31, ATELIER-32, ATELIER-33, ATELIER-34, ATELIER-35] partial: [] ship: milestone: v0.1 type: NFR tag: v0.0.7 merge: milestone/v0.1-atelier -> main release: https://git.cloudinit.dev/cloudinit-bot/atelier/releases/tag/v0.0.7 ---/ci--- Milestone v0.1 — Initial Framework (NFR, complete). 8 core principles (C1-C8), 11 domains, 110 domain principles, 27 derived docs, 4 good + 3 bad examples, 4 language docs, full matrix, 3 review docs. All 35 requirements covered. 7 patches (v0.0.0 pre-execution through v0.0.7 final). v0.0.7 IS the v0.1.0 milestone release.
50 lines
2.0 KiB
Markdown
50 lines
2.0 KiB
Markdown
# CI/CD — Derived Rules
|
|
|
|
> Derives from `domains/devops/first-principles.md` P2 (Automation), P4 (Rollback First), P5 (Progressive Delivery).
|
|
|
|
## The Pipeline is the Process (P2)
|
|
|
|
- If it is not in the pipeline, it does not happen. Manual deploys are a bug.
|
|
- The pipeline: lint → test → build → deploy → verify.
|
|
- Every step is scripted, versioned, and reproducible. No "run this command on the server."
|
|
|
|
## Lint (P2, core C2 Clarity)
|
|
|
|
- Run the linter on every commit. Fail the build on lint errors.
|
|
- Format check (prettier, gofmt, rustfmt). Format is not a debate; it is automated.
|
|
- Security lint (eslint-plugin-security, bandit, gosec). Catch the obvious ones.
|
|
|
|
## Test (P2, domains/testing)
|
|
|
|
- Unit tests in the pipeline. Fast. Every commit.
|
|
- Integration tests on merge to main. Slower. Every merge.
|
|
- E2E tests before deploy. Slowest. Every deploy candidate.
|
|
|
|
## Build (P7 Immutability)
|
|
|
|
- Build once. The artifact is immutable. The same artifact goes to every environment.
|
|
- The build is reproducible: same commit → same artifact (modulo timestamps, which are stripped).
|
|
- Build artifacts are signed and stored. A deploy is a reference to an artifact, not a rebuild.
|
|
|
|
## Deploy (P4 Rollback First, P5 Progressive Delivery)
|
|
|
|
- Every deploy has a rollback. The rollback is tested before the deploy.
|
|
- Progressive: canary (1% → 10% → 100%), blue-green, or feature flags.
|
|
- No big-bang deploys. A big-bang deploy is a rollback with no rehearsal.
|
|
|
|
## Verify (P3 Observability)
|
|
|
|
- After deploy, verify: health checks, smoke tests, metric watching.
|
|
- A deploy is not "done" when the code is on the server. It is done when the metrics are healthy.
|
|
- Auto-rollback on metric regression. The pipeline watches; humans sleep.
|
|
|
|
## What Violates CI/CD Discipline
|
|
|
|
| Violation | Principle |
|
|
|-----------|-----------|
|
|
| Manual deploy script | P2 Automation |
|
|
| No rollback path | P4 Rollback First |
|
|
| Big-bang deploy to prod | P5 Progressive Delivery |
|
|
| Rebuild per environment | P7 Immutability |
|
|
| Deploy without health check | P3 Observability |
|
|
| No lint in CI | P2, C2 | |