Automating the build.
WHAT THE PIPELINE SHOULD DO
Build the image Run tests Scan it Tag it Push it to a registry
WHAT TO TAG WITH
The commit identifier, always A version, for releases A branch name, for development builds
WHY THE COMMIT IDENTIFIER MATTERS MOST
It makes what is running traceable to exact source.
WHAT TO BUILD FROM
A clean checkout, never a developer's machine.
WHY
Local state produces images nobody can reproduce.
WHAT TO CACHE BETWEEN RUNS
Build layers, and dependency downloads.
WHY
Without it, every build starts cold and takes far longer.
WHAT TO RUN TESTS AGAINST
The built image, not the source.
WHY
It verifies what will actually be deployed.
WHAT TO FAIL THE BUILD ON
Failing tests Severe vulnerabilities, by policy Missing required labels
WHAT LABELS TO ADD
The source commit The build time The version
WHY
They answer what an image contains, months later.
WHAT TO NEVER PUT IN THE PIPELINE
Secrets in plain configuration.
WHAT TO USE
The pipeline's own secret storage, injected at run time.
WHAT TO PUSH
Only builds that passed.
