The Ideal CI Setup

If Pippa built it from scratch today

An idealized CI/CD setup for a 2026 project — small team, real users, modest scale. Compose it; don't build it all at once.

Repo-level baseline

• Branch protection on main: required CI green, strict status checks, merge queue, no force push, signed commits if practical.
• Secret scanning + push protection enabled.
• Dependabot alerts + version updates with auto-merge for patches.
• CodeQL on a weekly schedule.

Workflow library

• ci.yml — format → lint → type-check → unit → integration. Every PR. permissions: read, concurrency cancel-in-progress, paths-ignore for docs.
• release.yml — on tag push, builds, signs, publishes, creates GitHub Release.
• deploy-staging.yml — on merge to main, deploys to staging environment, smoke-tests.
• deploy-prod.yml — on workflow_dispatch with version input, prod environment with required reviewers + branch policy.
• nightly.yml — full test matrix, dependency audit, base image rebuild. Paired with workflow_dispatch.
• codeql.yml + dependabot-auto-merge.yml — security infrastructure.

Auth & secrets

• Cloud auth via OIDC. No long-lived keys.
• Org-level GITHUB_TOKEN default = restricted.
• Per-workflow explicit permissions:.
• Third-party actions SHA-pinned.
• Secret rotation runbook + quarterly drill.

Observability

• Step summaries with key metrics.
• Slack notifications on deploys (success and failure).
• Weekly digest job posting CI health (pass rate, p95 duration, flake rate).

For AI/ML services additionally

• Eval gate workflow with baseline-as-release-asset.
• Self-hosted runner for the heavy compute (Apple Silicon for MLX, GPU box for training).
• Model registry pushed by the training pipeline.
• API contract tests (mocked brain) + eval tests (real brain) as separate jobs.

The real value

None of this is exotic. Each piece is in some quest. The discipline is in having all of it on day one for a new project, instead of bolting things on after the first incident reminds you they're missing.