Markdown Editor
Open the editor

Software Delivery Kit

CI/CD pipeline design, IaC modules and golden paths, branching, versioning, feature flag, dependency and code ownership policies, release and DORA metrics.

Step 1

Platform and operability

  1. Platform Golden Path Specification Template

    Standard

    Golden path spec: target users, stack, scaffolding, CI/CD, environments, observability and security defaults, Backstage catalog

  2. CI/CD Pipeline Design Template (SLSA, NIST SP 800-204D)

    Full

    CI/CD design: stages and gates, environments and promotion, OIDC secrets, SBOM and provenance, rollout and rollback, CICD-SEC review, DORA metrics, traceability

    NIST SP 800-204D; NIST SP 800-218 SSDF 1.1; SLSA 1.2; OWASP Top 10 CI/CD Security Risks

  3. IaC Module Specification Template (OpenTofu, Terraform)

    Full

    One reusable IaC module: inputs and outputs, guardrails, security baseline, tagging contract, SemVer rules, tests and policy as code, deprecation

    SemVer 2.0.0; OpenTofu 1.13 and Terraform 1.17 module and test conventions
Step 2

Policies

  1. Branching Strategy Template (Trunk-Based, SLSA Source)

    Full

    Branching standard: model selection, naming, MUST/SHOULD rules, ruleset settings, SLSA Source mapping, merging, release branches, hotfixes, exceptions, metrics

    SLSA 1.2 Source track; DORA trunk-based development; Conventional Commits 1.0.0

  2. Versioning and Release Policy Template (SemVer, CalVer, CRA)

    Full

    Versioning policy: SemVer or CalVer rules, release types and cadence, changelog conventions, support tiers, LTS, CRA support period, backports, yanking

    SemVer 2.0.0; CalVer 26.0; Conventional Commits 1.0.0; Keep a Changelog 1.1.0; CRA Art. 13(8)-(11)

  3. Feature Flag Policy Template (OpenFeature)

    Full

    Feature flag standard: flag types and lifetimes, naming, metadata, lifecycle, rollout stages, kill switches, change control, testing, privacy, flag debt

    OpenFeature specification v0.9.0

  4. Dependency Management Policy Template (SSDF, Scorecard)

    Full

    Dependency policy: tiers, intake scoring, approved sources, lock files and SHA pinning, cooldown, update targets, malicious packages, licences, forks, metrics

    NIST SP 800-218 SSDF 1.1 PW.4; OpenSSF Scorecard v5; OSPS Baseline v2026.08.28

  5. Code Ownership Policy Template (CODEOWNERS)

    Full

    Code ownership policy: ownership models, RACI, MUST/SHOULD rules, CODEOWNERS standard and example, review SLAs, escalation, orphaned code, transfers, metrics

    GitHub and GitLab code owners documentation; SLSA 1.2 Source track
Step 3

Release and transition

  1. Software Release Checklist Template (Staged Rollout, SBOM, VEX)

    Full

    Per-release checklist: planning and pre-mortem, freeze, QA, security, 2026 SBOM fields, VEX and advisories, signing, ring rollout, emergency rollback, sign-offs

    CISA Safe Software Deployment (2024); CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1

  2. Deployment and Release Runbook Template

    Standard

    Deployment runbook: release metadata, pre-deploy checklist, go/no-go, steps with verification, canary rollout, rollback, comms

  3. Changelog Template (Keep a Changelog)

    Standard

    Keep a Changelog + SemVer

    Keep a Changelog

  4. Release Notes Template

    Standard

    Release notes: highlights, features, fixes, breaking changes with migration, deprecations with deprecation and sunset dates, CVE fixes, known issues, upgrade steps

    Semantic Versioning 2.0.0; RFC 9745 and RFC 8594 headers
Step 4

Assessments

  1. Software Delivery Performance Report Template (DORA Metrics)

    Full

    Quarterly DORA five-metric report per service, definitions and formulas, data quality, capability assessment, survey data, findings, actions

    DORA metrics guide (2026-01-05); DORA capabilities; SPACE 2021; DevEx 2023