DevOps / Platform
CI Quality Gate at Scale
A parallel, advisory-first quality gate fronting a 200+ repository estate.
Promotion — the same image moves right
feature/* · fix/*
No approval
integration
QA testing
main
Prod-like staging
main
Live traffic
How a change travels
- 01feature/* or fix/*
developer branches
- 02Open PR → integration
- 03PR Gate
policy check + code review
- 04Merge to integration
- 05Deploy → SIT
QA validates
- 06Open PR integration → main
- 07PR Gate + QA sign-off
SIT tested
- 08Merge to main
- 09Promote the SAME image
Replica → Prod · TL then RM approve
A failing gate routes back to the developer as changes requested — the loop most diagrams leave out, and where the majority of cycle time actually goes.
Security scans — every build, every PR
- SASTFortifyStatic analysis of our own source
- SCABlackDuckOpen-source dependencies and licences
- CVETrivyContainer image vulnerabilities, High/Critical
- SIGNcosignImage signing and SBOM
- SECRETGSMSecret verification before deploy
Any Critical or High finding blocks the merge. Results are emailed to whoever triggered the pipeline, pass or fail, with links to the reports.
GitOps — Git is the desired state
CI Pipeline
build · test · security, then record the intent
Git — single source of truth
image tag + config per environment
ArgoCD
watches Git, syncs every ~30s
GKE Clusters
Dev · SIT · Replica · Prod
Self-heal. ArgoCD compares live against Git continuously and corrects drift, so a manual change to a cluster is reverted rather than inherited.
Rollback is reverting the Git commit. There is no separate rollback procedure to get wrong at 2am.
Controls, and what each one buys
| Control | What it prevents | Who it protects |
|---|---|---|
| PR / branch-protection gates | Unreviewed or non-compliant code merging | Whole org |
| Quality + coverage gates | Poorly-tested changes shipping | Product quality |
| Vulnerability scanning | Known security flaws reaching prod | Security posture |
| Image signing | Tampered or unverified images running | Supply-chain integrity |
| Secret pre-verification | Half-configured, failing deployments | Reliability |
| Tiered approval gates | Unapproved promotion to higher environments | Governance |
| Health check + auto-rollback | A bad deploy causing an outage | Uptime |
| Immutable, promoted images | "It worked in test but not prod" | Predictability |
| GitOps audit trail | Untracked or undocumented changes | Compliance / audit |
What it took
Lint, test, coverage and security scanning run concurrently per pull request instead of serially per repo, cutting gate time substantially. Rolling it out in advisory mode first let teams onboard without blocking merges on day one, and a per-PR scan cap kept static-analysis spend bounded. Artifact resolution mints short-lived cloud credentials so private package registries resolve inside the gate without long-lived secrets.
- CI/CD
- Python
- Bash
- Artifact Registry
- SAST
Outcome
- 200+
- repos
- -60%
- gate time
- advisory
- rollout
This system, elsewhere
Next case study
Self-Service Infrastructure Provisioning ↗