The summary.
RUN CHECKS ON EVERY CHANGE, AUTOMATICALLY
Installs, tests, static analysis, formatting, secrets scanning.
A problem found within minutes by the person who caused it is cheap. The same problem in production is not.
KEEP THE FAST CHECKS FAST
Move slow tests elsewhere, or people work around the pipeline.
AN INTERMITTENT TEST COSTS TRUST IN THE WHOLE SUITE
Fix it or remove it. Never leave it failing sometimes.
INSTALL FROM THE LOCK FILE, NEVER UPDATE, IN A PIPELINE
An update means the build tests something different from what you deploy.
WHEN ADDING ANALYSIS TO EXISTING CODE, SET A BASELINE
Otherwise the first run reports thousands of issues and the tool gets abandoned. Prevent new problems, then raise strictness gradually.
BUILD ONCE, DEPLOY THE SAME ARTEFACT EVERYWHERE
Building separately per environment means each gets something slightly different.
Never build on the production server.
FIX A BROKEN MAIN BRANCH IMMEDIATELY
It blocks everyone and normalises failure.
