CI/CD Pipeline

---
doc_type: "ci-cd-pipeline"
variant: "light"
status: "draft"
owner: "<your-name>"
last_updated: "YYYY-MM-DD"
upstream:
  required: ["current-pipeline-yaml", "dora-targets"]
  optional: ["security-policy"]
---

# CI/CD Pipeline Audit: <repo-name>

**Status:** Draft v0.X · **Owner:** <DevOps name> · **Last updated:** YYYY-MM-DD

> [!IMPORTANT]
> **AI 填寫規則：** 本範本 6 段（編號 1, 2, 3, 5, 7, 10），全部必填——刻意沿用完整版的章節編號讓兩版可對照。每結論行內加 `（依據：pipeline-yaml §XXX / dora §YYY）`；每量化欄位加 `[H]/[M]/[L]` confidence badge；缺資料寫 `_TODO: 需要 XXX_` 不編造；Redundancy 識別必須附「移除後對 DORA metric 的預估影響」。

---

## 1. Executive Summary

<!-- ai-fill: 3-5 行，Dev Lead 30 秒讀完。寫「目前 pipeline 多長、最弱的 gate、最大的 supply-chain gap」 -->

<3-5 行說明>

> **TL;DR:** <一句話：最該動的 stage + 預估 lead time 縮短>

---

## 2. Stages

<!-- ai-rule: 至少 5 個標準 stage（lint / test / build / sec_scan / deploy / smoke）。每階段標 duration_p95 + 是否可並行 -->

| Stage | Purpose | Duration p95 | Parallelizable | Confidence |
|---|---|---|---|---|
| lint | 風格 + 靜態檢查 | 1 min | yes | **[H]** |
| test | unit + integration | 6 min | yes | **[H]** |
| build | 產出可重現 artifact | 4 min | no | **[H]** |
| sec_scan | SAST / SCA / secret scan | 3 min | yes | **[M]** |
| deploy | rollout to staging | 2 min | no | **[H]** |
| smoke | post-deploy 健康檢查 | 1 min | no | **[H]** |

---

## 3. Gates per Stage

<!-- ai-rule: 每階段必須有明確 gate 與 fail_action（block / warn / manual_review）。輕量版至少覆蓋 test / sec_scan -->

| Stage | Gate | Fail action | Confidence |
|---|---|---|---|
| test | unit coverage ≥ 80% | block | **[H]** |
| sec_scan | SAST high = 0 · secrets = 0 | block | **[H]** |
| smoke | health endpoint 200 in 30s | block | **[H]** |

---

## 5. Secret Management

<!-- ai-rule: 必含 storage / rotation / audit_log 三件；缺一即 supply-chain risk -->

- **Storage:** <vault / OIDC short-lived / env> **[H]**
- **Rotation:** <policy + interval> **[M]**
- **Audit log:** required / _TODO: 缺 audit trail_

---

## 7. Redundancy to Remove

<!-- ai-rule: 至少列 1 條冗餘 stage + DORA 影響估算 + 移除後風險 -->

| Stage / step | Reason redundant | DORA impact | Risk if removed |
|---|---|---|---|
| <例：重複的 lint job> | <為何重複> | lead time -2 min | <例：失去某 PR check> |

---

## 10. Decision Log（key 2-3 條）

<!-- ai-rule: 每條必含 chosen + 至少 1 個 rejected option + 拒絕原因 -->

| Date | Decision | Options | Chosen | Rejected why | Confidence |
|---|---|---|---|---|---|
| YYYY-MM-DD | runner 選型 | self-hosted vs managed | managed | self-hosted (維運成本 > 收益) | **[H]** |

---

> [!CAUTION]
> **輸出前 AI 自檢：**
> - [ ] 6 段 H2 章節齊全（編號 1, 2, 3, 5, 7, 10）
> - [ ] Stages 表至少含 lint / test / build / sec_scan / deploy / smoke
> - [ ] Gates 段至少覆蓋 test + sec_scan 兩階段
> - [ ] Secret management 含 storage / rotation / audit_log 三件
> - [ ] Redundancy 段附 DORA impact 估算
> - [ ] Decision Log ≥ 1 條，含 rejected reason
> - [ ] 無 YAML / JSON schema 輸出