Checklist
CI/CD pipeline health checklist
How to tell whether a CI/CD pipeline is helping or hurting: build reproducibility, release safety, rollback and feedback speed.
Builds
- The same commit produces the same artefact, and the artefact is built once and promoted.
- Dependencies and base images are pinned, and updates arrive through reviewed changes.
- Flaky tests are tracked and fixed or quarantined, not retried until they pass.
- Pipeline definitions live in version control and are reviewed like application code.
Releases
- Deploys use immutable images, not in-place changes to running servers.
- There is a blue/green or canary path, and it has been used in anger.
- A rollback takes one step and has been rehearsed.
- Database migrations are backward compatible with the previous release.
Safety
- Secrets are injected at run time and never printed to build logs.
- Production deploys need an explicit gate, and the approver is a named role.
- Every deploy is traceable to a commit, a person and a time.
Feedback
- Engineers trust a red build, and a red build blocks the merge.
- Failed deploys are reviewed, and the review produces a change to the pipeline.
- Someone owns the pipeline, with time set aside to maintain it.
Want someone to run through this with you?
The CI/CD hardening or migration does exactly that: 1,400 – 3,360 EUR, Scoped on the call.