Pillar 06 · Govern
Enforce Conventional Commits with commitlint, then let semantic-release and Changesets compute the semver bump, changelog, tag, and release from CI, no human deciding the number.
When developers can deploy to production, SOX segregation-of-duties and change-approval controls have to live in the pipeline and be evidenced automatically. Here is how to make CI/CD auditable.
Why we dropped Gitflow’s develop, release and hotfix branches for trunk-based development, and the branch-protection rules and feature flags that made merging to main many times a day safe.
A from-scratch GitHub Actions workflow that lints, tests and reports coverage on every push and pull request with uv, ruff and pytest, plus the branch-protection settings that make the checks actually block a bad merge.
Big-bang schema changes cause outages. The expand-contract pattern lets you evolve a live database in a controlled series of safe, reversible steps.
Author an OpenAPI 3.1 document first, lint it with Spectral, mock it with Prism, then generate a typed client so the spec gates the build rather than trailing it.
In most firms, prompt and chain changes ship with no regression testing at all. An LLM eval gate built with Promptfoo scores every change in CI and blocks the quality drop before a customer sees it.
Data Act Article 36 requires smart contracts for automated data sharing to support safe termination and archiving. Engineer the stop and the record in from the start, because retrofitting a kill-switch onto deployed, immutable code is the exact problem the rule exposes.
Actuarial and capital models are software. Applying version control, reproducible pipelines and genuinely independent validation closes the gap regulators keep probing between spreadsheet reality and governance claims.
Read before you write, back up the exact subtree with reg export, write typed values, and hold a documented rollback — the PowerShell registry pattern change control accepts.