SDLC · Stage 03 of 07
Build and test
Build without special privileges, change shared things carefully, and test against the real thing.
Principles: The platform is a product, Event-driven by default
Nobody should have to be a CI expert to ship software. The goal here is a pipeline that feels boring in the best way: it runs, it's fast, and when it fails it tells you why in plain words.
The pipeline is a fixed superset DAG whose stages are switched on and parameterised by cicd.yaml, not an arbitrary graph compiled from user config. That is a deliberate limit: it keeps every tenant's pipeline recognisable and supportable, and a compiler is a heavier pattern than the problem has needed so far.
Images are built with kaniko under Pod Security Standards restricted: no privileged daemon, no host access, on any cluster. The shared Tekton catalog is a Helm release pinned by git tag, so upgrading a tenant is a reviewed change to a pin and a catalog change can be tried on a canary tenant first. Stages are separate PipelineRuns chained by events, which keeps each one small and independently re-runnable.
Tests run in Testkube, and that decision is a good example of the habit behind this site: the documented multi-namespace mode turned out, in the source code, to be gated to a paid edition. The design that shipped runs in one shared namespace and closes the resulting secret-isolation gap with an admission policy.
Where Hangar does this
And for AI agents
CI is the loop an agent retries against
For an agent, the pipeline is not just a gate; it is the feedback signal. Fast, deterministic checks with readable errors are what let an agent fix its own change before a human ever looks at it.