---
description: CI/CD and GitOps—pipeline stages (validate, test, build, scan, sign, deploy), Argo CD, trunk-based flow. Immutable artifacts; Git as source of truth.
alwaysApply: false
---

# CI/CD & GitOps

Guidelines for reliable, secure delivery pipelines.

## Core Principles

1. **Everything as Code** - Pipelines and config in Git.
2. **Trunk-Based Development** - Short-lived branches, frequent integration.
3. **Shift Left** - Lint, test, scan early.
4. **Immutable Artifacts** - Build once; deploy by digest/tag.
5. **GitOps** - Git is source of truth; controllers reconcile.

## Pipeline Stages

- **Validate**: Lint (code, Dockerfile), format, schema validation (Terraform/K8s). Run on every PR.
- **Test**: Unit + integration (with services if needed); coverage upload. Fail on failure.
- **Build**: Container build and push; use cache (e.g. GHA cache); tag with SHA and optionally semver.
- **Scan**: Trivy (or similar) on image; fail on CRITICAL/HIGH; upload SARIF. Optional SAST/DAST.
- **Sign**: Cosign (or equivalent) after scan; keyless or key-based.
- **Deploy**: Update GitOps repo (image tag/digest); Argo CD (or Flux) syncs. Staging first; production after approval or main.

## Pipeline Structure (Example)

Use separate jobs for validate → test → build → security-scan → sign → deploy-staging → (optional integration) → deploy-production. Use `needs` and `environment` for staging/production. Store image digest as job output; pass to deploy step. For GitOps, checkout GitOps repo, update image in overlay (e.g. kustomize edit set image), commit and push. Use id-token write for OIDC where applicable.

## GitOps (Argo CD)

- **Application**: source.repoURL, path to overlay, targetRevision HEAD; destination server and namespace; syncPolicy automated (prune, selfHeal); syncOptions CreateNamespace=true, PruneLast=true; retry with backoff.
- **No manual kubectl apply in production** - All changes via Git commits; Argo reconciles.
- **Environments**: Separate overlays (e.g. staging, production) with different replicas, resources, secrets.

## Security in Pipeline

- No secrets in workflow as plaintext; use secret refs. Use OIDC for cloud (e.g. AWS assume-role). Sign artifacts; verify in cluster (e.g. Kyverno).

## Definition of Done (Pipeline)

- [ ] Validate and test gates on PR; build and deploy on main (or release).
- [ ] Image scanned and signed; GitOps repo updated by automation only.
- [ ] Rollback = revert Git commit and let GitOps sync.

## Common Pitfalls

- **Long-running branches** - Integrate frequently; avoid big-bang merges.
- **Deploying from local** - All production deploys from CI and GitOps.
- **Skipping scan or sign** - Don’t bypass; fix or gate on severity.