# Senior CI/CD playbook

Compressed reference for the senior-only CI/CD extension. Pair with [cheat-sheet.md](./cheat-sheet.md), [GLOSSARY.md](./GLOSSARY.md), and [repo-cicd-map.md](./repo-cicd-map.md).

## The senior shift
Intermediate understanding is: "I know the repo’s CI pipeline, build chain, deploy mechanics, runners, auth, and supply-chain tools."

Senior understanding is: "I can explain what the pipeline truly guarantees, where the safety story is partial, how rollback and blast radius really work, and how to review the delivery design honestly."

## Six senior lenses
1. **Truthfulness beats simplification** — explain what really happens after merge, not the cleaner story people wish were true.
2. **Guardrails have strength levels** — a control may exist, but that does not mean it blocks the bad outcome yet.
3. **Rollback is part of design** — a delivery story is only strong if the recovery story is concrete too.
4. **Supply-chain security is layered** — separate identity, artifact proof, and enforcement.
5. **Blast radius belongs in deployment design** — matrix fan-out and rollout cadence shape how widely bad releases spread.
6. **Review is about guarantees and operability** — ask what the system truly enforces, how understandable it is, and how it fails under pressure.

## Senior review checklist
- What exactly happens after merge, and where is the real release boundary?
- Which controls are hard gates vs audit-only or partial pathways?
- Is the rollback path concrete enough to use quickly under stress?
- How much blast radius does this rollout shape create before detection?
- Are runner, cache, and reuse patterns operationally justified, or just inherited complexity?
- Does the security explanation separate identity, proof, and enforcement honestly?
- Could a new engineer operate this delivery path correctly from the docs and workflow names alone?

## Interview answer shapes
### Why is “merge deploys” inaccurate here?
Because merge to develop creates a release tag, then a later cron picks it up for staging build/deploy, while prod remains behind manual dispatch.

### What makes a partial guardrail dangerous?
It can create false confidence — the team may think the pipeline blocks risks that it only audits or signals.

### What is the honest rollback story?
Rollback means redeploying a known previous release tag through the same push-based path; that is operationally clear, but still depends on detection speed and rollout spread.

### How would you summarize the repo’s CI/CD security posture?
Keyless short-lived auth is strong, attestation machinery exists, and runtime enforcement is still audit-only today.

### What is the real job of a senior CI/CD reviewer?
To ask what the pipeline truly guarantees, where the story is partial or misleading, how recoverable failures are, and how understandable the system stays under pressure.