Knowledge check Choose an answer to see why it is right or wrong.
JavaScript is off, so every explanation is shown at once.
01 A pull request passed the local pre-commit hook cleanly, but its CI run is red on the coverage gate. Which statement matches the standard?
CI is the real gate and the local hook is only its fast mirror; the merge is blocked until the coverage gate is green, regardless of what the hook reported. Correct. ADR 0017 states CI is the real gate and local hooks are only the fast mirror. The hook can run on a stale tree or be skipped, so a green hook never overrides a red required check. The local hook is authoritative because it ran on the developer's actual working tree, so the red CI result can be overridden. Incorrect. The hook is a mirror, not the gate. It can be skipped or run against a stale tree; only the canonical CI run on the merge candidate is recorded evidence. Coverage is an optional stage, so a red coverage gate is a warning that does not block the merge. Incorrect. The coverage gate is part of the mandatory floor on every pull request; a failed mandatory gate is fail-fast and blocks the merge. 02 Which set is the mandatory CI floor that every pull request must pass, for all project types?
Checkout and toolchain, resolve and cache, format check, lint, build, unit tests, the coverage gate, secret scan, SAST, SCA and license, and docs-required. Correct. The CI/CD standard names exactly this floor as mandatory on every PR for all project types; the remaining stages are conditional on project type and risk class. Only build and unit tests - everything else, including secret scanning and docs-required, is enabled per project type. Incorrect. The secret scan, SAST, SCA and license, and docs-required are all part of the mandatory floor, not project-type add-ons. The full stage set including container scan, SBOM, and E2E, because every stage is mandatory on every repository. Incorrect. Container scan, SBOM and provenance, and E2E are conditional - they run only where the project ships that surface or a public contract exists. 03 A team wants to add a custom lint step by copying the org quality-gate workflow into their repo and editing it. What does the standard require instead?
Repos call the org reusable workflows and pass inputs; stage logic lives only in the reusable set, so a customization is an input, never a fork of the workflow body. Correct. ADR 0017 and the pipeline standard require thin callers that wire reusable workflows by SHA-pinned reference; forking the body causes gate drift and is disallowed. Each repo should maintain its own copy of the workflow so teams can move independently. Incorrect. Per-repo bespoke workflows were explicitly rejected in ADR 0017 because they guarantee gate drift and unauditable inconsistency across the estate. Copy the workflow but pin it to a branch instead of a SHA so it stays up to date automatically. Incorrect. The standard requires every uses: to be pinned to a full commit SHA, and it forbids forking stage logic at all - the fix is to call the reusable workflow, not to copy it. 04 A release is ready to promote to prod. Under the deployment model, what happens at the production gate?
The signed digest is verified (failing closed if unverifiable), then a human approves the manual promote in a protected environment with prevent-self-review and admin bypass disabled; agents and CI never self-approve prod. Correct. The deployment standard and ADR 0017 make prod a manually promoted, protection-gated environment with signature verification that fails closed and a human holding the gate under separation of duties. CI applies the change directly to the prod cluster once staging is green, since automation removes the need for a human step. Incorrect. Delivery is pull-based GitOps: CI never applies to a cluster, and prod always requires a human approval - agents propose, humans enact. A fresh artifact is rebuilt for prod from the release tag to guarantee it matches production settings. Incorrect. You promote the same signed digest forward across environments; a rebuilt binary is a different, unverified artifact, which the standard forbids.