What should a CI/CD pipeline include?

A strong pipeline, in order:

1. Pull request → scope and code-owner review → deterministic install
2. Format, lint, typecheck, unit tests
3. Database migrations from a clean baseline + constraint and RLS tests
4. Integration, API-contract and critical end-to-end tests
5. SAST, secret scanning, dependency/SBOM and container/IaC scans
6. Staging deploy + smoke tests + observability check
7. Protected-branch gate and approved production promotion with serialised migrations
8. Canary or feature flags, post-deploy checks, and a rollback decision

Release gates: exact commit SHA recorded, every required check green, production secrets isolated (short-lived cloud identity via OIDC), rollback tested for schema/auth/cache changes, demonstrated load capacity for the target, on-call contacts and runbooks ready. A broken CI runner is not a passed test — document the blocked gate instead of silently merging.