Reference architecture
Secure CI/CD pipeline
Every change passes static, dependency, and dynamic checks before an immutable, pinned artifact is promoted through GitOps.
Secure CI/CD pipeline
01
Commit
- Branch protection
- Secret scanning
02
Build
- Pinned base images
- Build once
03
Gates
- SonarQube
- Dependency audit
- OWASP ZAP
04
Registry
- Immutable tags
- Digest pinning
05
Deploy
- ArgoCD
- Env promotion
Security plane
Vault secrets · OIDC to cloud · No long-lived CI keys
Design decisions
DECISION 1
Gates fail closed: a report nobody reads isn't a control.
DECISION 2
The artifact tested in staging is byte-for-byte the one in production.
DECISION 3
CI never holds cluster credentials; GitOps pulls instead of CI pushing.
Components
- Commit
- Branch protection · Secret scanning
- Build
- Pinned base images · Build once
- Gates
- SonarQube · Dependency audit · OWASP ZAP
- Registry
- Immutable tags · Digest pinning
- Deploy
- ArgoCD · Env promotion