How would you design a multistage CI/CD pipeline with gates between build, test, scan, package, and deploy?
Whether you can sequence stages for fast feedback and safety at once, and decide which gates block a release versus which only warn, instead of bolting every check onto one giant job.
I'd split the pipeline into ordered stages with explicit gates between them: build once, run unit tests and linting in parallel, then security and dependency scans, then package an immutable signed artifact, then promote it across environments. The build artifact is created exactly once and carried forward by digest, never rebuilt per environment. Gates that block include failing tests and high-severity vulnerabilities; gates that warn feed dashboards. On GitHub Actions I'd use upload-artifact v4, OIDC for keyless cloud auth, and cosign to sign the image so deploy verifies provenance.
Build once, gate often, promote by digest.
- How do you keep the pipeline fast as it grows?
- How does the artifact prove it is the one you tested?
- Where does GitOps fit into this pipeline?
In the book this question runs three pages: it adds a deep dive with a diagram, a decision framework, a pitfalls table and a worked answer to each follow-up.