> For the complete documentation index, see [llms.txt](https://framework.aic.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://framework.aic.io/technical-guidelines-code-standards-and-tech-stack/devops-repository-and-release-standards/ci-pipeline-standards.md).

# CI Pipeline Standards

## Purpose

CI pipelines enforce repeatable quality controls.

## Required CI Stages

A production pipeline SHOULD include:

1. checkout
2. SDK validation
3. restore
4. format verification
5. build
6. unit tests
7. integration tests where practical
8. static analysis
9. dependency vulnerability scan
10. package or publish
11. artifact upload
12. evidence retention

## Example Command Sequence

```bash
dotnet restore
dotnet format --verify-no-changes
dotnet build --configuration Release --no-restore
dotnet test --configuration Release --no-build --collect:"XPlat Code Coverage"
```

## Quality Gate

A merge is blocked if:

* build fails
* tests fail
* formatting check fails
* required analyzers fail
* critical vulnerability is detected
* required approval is missing
* generated API contract changed without review

## Pipeline Evidence

Retain:

* build logs
* test results
* coverage report
* static analysis report
* vulnerability report
* artifact version
* commit SHA
* release notes

## Build Reproducibility

CI must use:

* pinned SDK
* approved package sources
* deterministic build settings where practical
* clean checkout
* no hidden local dependencies
* environment variables documented