Lesson 3 of 19Article14 min
CI/CD at Organization Level
At org scale, CI/CD is not 'run npm test on GitHub.' It is a contract between engineering, QA, product, and operations. Everyone agrees on: who merges to main, who approves releases, how hotfixes branch, where artifacts live, and what 'done' means for a release.
CI/CD is a team contract
At org scale, CI/CD is not 'run npm test on GitHub.' It is a contract between engineering, QA, product, and operations. Everyone agrees on: who merges to main, who approves releases, how hotfixes branch, where artifacts live, and what 'done' means for a release.
Without this contract, you get shadow releases (someone builds locally), untested main branches, and blame games when production crashes.
Org CI/CD layers
Org-level principles
- Trunk-based development with short-lived feature branches — standard for mobile teams shipping weekly.
- Long-lived release branches only when maintaining multiple app versions live in stores simultaneously.
- Every merge to main must produce a testable build on Internal / TestFlight within 30 minutes.
- Separate pipelines by speed: PR validation (<15 min) vs nightly (full E2E) vs release (signed + upload).
- Secrets in vaults — GitHub Encrypted Secrets, GCP Secret Manager, 1Password — never in git history.
- Artifact retention policy: keep last N release APKs/IPAs for rollback comparison.
Roles and responsibilities
- Developers: write tests, keep PRs green, document native changes.
- QA: define smoke vs regression suites, sign off staging before production promotion.
- Release manager / tech lead: cut release branches, approve SEMVER bumps, coordinate store metadata.
- DevOps / platform: maintain runners, secrets rotation, pipeline cost optimization.