# A pipeline where failed merges never deploy

Building IoT platform (Primustech), 2026. Case study by Li ZhenXi. Page: https://portfolio-emsghin2iq-as.a.run.app/work/pipeline

> I own the Cloud Build delivery pipeline: build once, promote by digest, approve before release.

- **169**: of my pull requests merged on the platform so far
- **1**: image digest per release: built once, then promoted
- **0**: red merges that reached production

## The problem

Builds and deploys were coupled, so what reached production was not always the image that had been tested, and infrastructure drifted from Terraform.

## What I did

1. Split build from deploy so a release promotes the exact image digest that passed its checks.
2. Added pull-request, post-merge and Terraform drift gates, a CRITICAL-CVE image gate and weekly base-image rebuilds.
3. Made releases and Terraform applies approval-gated and serialised per component, then moved the repository from Bitbucket to GitHub with full history.

## Result

169 of my pull requests merged so far. A red merge never reaches production.

Tools: Cloud Build, Artifact Registry, Artifact Analysis, GitHub, Terraform.

## Go further

- [The same habit on this site: the smoke test that gates every deploy, and its postmortem](https://portfolio-emsghin2iq-as.a.run.app/postmortems/smoke-test)