ci-cd-quality-gateslisted

# CI/CD Quality Gates A pipeline is a risk-control system. Order checks to provide cheap feedback early, preserve trustworthy artifacts, and make deployment and recovery routine. Continuous delivery means releasable on demand; continuous deployment is an optional policy that deploys automatically. ## Workflow 1. Inspect the current pipeline, repository, build tool, environments, artifact registry, secrets mechanism and branch/release policy. 2. Define the supply-chain boundary and required evidence: source revision, dependency lock, build result, test reports, scan reports, artifact digest/provenance and approvals. 3. Model stages: validate -> build -> unit/component -> contract/integration -> security/SAST/SCA -> package/sign -> deploy ephemeral/staging -> acceptance/performance as appropriate -> promote -> deploy -> verify/observe. 4. Put fast deterministic gates before expensive suites; make gate ownership and failure action explicit. 5. Enforce least privilege, pinned dependencies, isolated runners, secret injection, artifact immutability, retention and redaction. 6. Define promotion, approval, feature flags, canary/blue-green, rollback triggers and rollback verification. 7. Validate with a safe representative change, failure injection or pipeline linting without touching production. ## Gate policy template ```markdown | Gate | Signal/evidence | Blocking? | Owner | Trigger | Failure action | |---|---|---:|---|---|---| ``` ## Release checklist - Reproducible build f