CI/CD pipeline with gated deploy
Flowchart of a trunk-based CI/CD pipeline — build, test, security scan, staging gate, and production deploy with automatic rollback on failed smoke tests.
For the platform engineer
Scenario
A platform engineer is documenting the team's trunk-based pipeline for a new-hire runbook. The diagram makes the four automated gates (tests → scan → smoke → post-deploy health) and the single human gate (manual approval) obvious at a glance, and shows that every failure path terminates the pipeline rather than silently continuing.
Annotation key
([…])— stadium; start and terminal nodes{…}— diamond; automated or manual gate[…]— rectangle; build / deploy / scan step-->|Yes/No|— branch labels on each gate
How to read
Start at Push to main. Every diamond is a gate — a No on any of unit tests, CVE scan, or smoke tests terminates at Fail build. Manual approval is the only human gate; it can park the pipeline at Await approver without failing. The post-deploy health check guards production: a failure triggers automatic rollback, which still completes at Release complete because the rollback itself is a successful outcome.