mediumDesignConceptMidSeniorStaff
You need every service's pipeline to run a security scan, a license check, and require signed artifacts before deploy. How do you enforce that across a hundred repositories without ending up with a hundred slightly different pipeline files?
4 min readUpdated 2026-08-15
Answer
Short answer
Ship the gates as a shared, versioned pipeline template that repositories include rather than copy, so an update to the check propagates everywhere at once and drift is visible instead of silent.
Was this answer helpful?
Likely follow-ups
- How would you roll out a new mandatory gate to a hundred existing repositories without breaking all of their pipelines simultaneously?
- What do you do when the security scanner itself has a false-positive rate high enough that teams start ignoring its findings?
- How does versioning the shared template work when one team needs to stay on an older version temporarily and others want the latest?
- Who owns the shared template, and what happens when a change to it needs sign-off from both the platform team and a security team?
Related questions
- How do you ship a change to a production prompt safely?mediumAlso on ci-cd4 min
- What belongs in an architecture decision record, and how do you decide a decision deserves one?mediumAlso on governance6 min
- A customer reports seeing another company's records in your admin console. Walk me through the first hour, and then tell me what you change so this class of bug cannot happen again.hardAlso on security4 min
- Which tests should run on every commit and which should run nightly, and how do you decide?mediumAlso on ci-cd7 min