Stage 2: Build — From Source to Immutable Artifact

The runner checks out the code, restores cached dependencies, and produces an artifact. For our Python service that means: pip install -r requirements.txt, then docker build. The output is a container image tagged with the commit SHA — never :latest, never a mutable tag, because immutability is the only way to guarantee that what you tested is what you deployed.

Build cache strategy is where teams get most of their wall-clock-time wins. A cold build of a typical Python service takes 4-6 minutes. With a warm dependency cache (BuildKit cache mounts, GitHub Actions cache action) the same build runs in 30-60 seconds. The investment in cache plumbing pays back inside the first month.

Stage 3: Test — Where Pipelines Live or Die

The longest stage in almost every real pipeline. Three test layers run in parallel where possible:

• Unit tests — fast (sub-2 minutes), no external dependencies, run on every commit
• Integration tests — slower (5-15 minutes), spin up dependencies in containers, run on PRs to main
• Contract tests — verify provider/consumer compatibility against pinned contract versions, run on schedule and on release branches

A pipeline that takes 25 minutes is not a pipeline; it is a daily inconvenience. The standard goals are: PR feedback in under 10 minutes, full main-branch validation in under 20. Hitting those numbers requires test parallelisation, hermetic test environments (testcontainers, ephemeral databases), and a ruthless quarantine policy for flaky tests.

Stage 4: Security and Quality Gates

Security gates run after tests pass. The four most common are:

• SAST (Semgrep, CodeQL) — scans source for vulnerable code patterns
• SCA (Snyk, Dependabot, Trivy) — scans dependencies and container layers for known CVEs
• Container scanning (Trivy, Grype) — scans the built image for OS-package vulnerabilities
• Policy gates (Open Policy Agent, Conftest) — enforces organisational rules (e.g., "no images may run as root")

The hard part here is calibrating severity thresholds. Failing the pipeline on every CRITICAL CVE is correct; failing it on every LOW CVE creates pipeline-fatigue and gets the gate disabled. Most mature teams fail builds on HIGH and CRITICAL with documented exceptions tracked in a vulnerability register.

Stage 5: Package and Publish

The validated image is signed (cosign, Sigstore) and pushed to the registry. The signature creates an audit-grade chain from the commit SHA through the test results to the deployed artifact — a control that is increasingly required for SLSA Level 3 attestations and EU Cyber Resilience Act compliance.

Stage 6 and 7: Manifest Update and ArgoCD Sync

This is where push-based CI hands off to pull-based CD. The CI workflow opens a small PR against the config repo, changing one line: the image tag. A reviewer (or, in lower environments, an auto-merge bot) merges it. ArgoCD, which polls or watches the config repo, detects the change within 30-60 seconds.

The architectural advantage of this handoff is that the cluster credentials never leave the cluster. CI doesn't need kubectl access to production. The only thing CI can do is open a PR. ArgoCD, running inside the cluster, has the credentials it needs to reconcile state. This is the security property that makes how Opsio delivers argocd gitops the dominant CD pattern on Kubernetes.

Stage 8: Reconcile — From Manifest to Running Pod

ArgoCD compares the new declared state to the live cluster state and starts a sync. With Argo Rollouts in place, the rollout proceeds as a canary: 5% of traffic for 5 minutes, then 25%, then 100%, with health checks at each step. If error rates spike or latency degrades, the rollout aborts and reverts. The full deployment, from PR-merge to 100% traffic, runs unattended in 15-25 minutes for a typical service.

How Opsio Helps

Opsio designs and operates the full pipeline shown above. Our Opsio's pipeline services cover GitHub Actions or GitLab CI for CI, image signing and policy gates, GitOps with ArgoCD, and progressive delivery with Argo Rollouts. Customers in regulated sectors also leverage our request an ISO certification readiness review evidence pack, which maps each pipeline gate to ISO 27001 Annex A controls so audit prep takes hours instead of weeks.

For hands-on delivery, see managed cloud adoption.

For hands-on delivery, see managed mlops services.