Decide whether the actual merge candidate, complete supported matrix, isolated tests, and promoted artifact have enough evidence to release. A green job from a different revision or digest does not answer that question.
Review these lessons
- Merge queue checks: test the combined commit that will land
- Selective CI: default to full verification when impact is uncertain
- Flaky tests: quarantine one failure mode with an owner and expiry
- CI test data: give each run an isolated ownership scope
- Hermetic CI tests: declare every service and input the check consumes
- CI matrix gates: distinguish skipped, canceled, experimental, and passed
- Tested artifact identity: deploy the bytes that passed
- Reproducible builds: investigate why equal inputs produce different bytes
Other checks
Common Mistakes
- Do not count an absent check as a pass.
- Do not deploy a rebuilt image after testing a different digest.