CI Pipeline Standards

Purpose

CI pipelines enforce repeatable quality controls.

Required CI Stages

A production pipeline SHOULD include:

1. checkout

2. SDK validation

3. restore

4. format verification

5. build

6. unit tests

7. integration tests where practical

8. static analysis

9. dependency vulnerability scan

10. package or publish

11. artifact upload

12. evidence retention

Example Command Sequence

dotnet restore
dotnet format --verify-no-changes
dotnet build --configuration Release --no-restore
dotnet test --configuration Release --no-build --collect:"XPlat Code Coverage"

Quality Gate

A merge is blocked if:

• build fails

• tests fail

• formatting check fails

• required analyzers fail

• critical vulnerability is detected

• required approval is missing

• generated API contract changed without review

Pipeline Evidence

Retain:

• build logs

• test results

• coverage report

• static analysis report

• vulnerability report

• artifact version

• commit SHA

• release notes

Build Reproducibility

CI must use:

• pinned SDK

• approved package sources

• deterministic build settings where practical

• clean checkout

• no hidden local dependencies

• environment variables documented