소프트웨어 딜리버리 키트
CI/CD 파이프라인 설계, IaC 모듈과 골든 패스, 브랜치, 버전 관리, 기능 플래그, 의존성, 코드 소유권 정책, 릴리스와 DORA 지표.
플랫폼과 운영성
Platform Golden Path Specification Template
표준Golden path spec: target users, stack, scaffolding, CI/CD, environments, observability and security defaults, Backstage catalog
CI/CD Pipeline Design Template (SLSA, NIST SP 800-204D)
전체CI/CD design: stages and gates, environments and promotion, OIDC secrets, SBOM and provenance, rollout and rollback, CICD-SEC review, DORA metrics, traceability
NIST SP 800-204D; NIST SP 800-218 SSDF 1.1; SLSA 1.2; OWASP Top 10 CI/CD Security RisksIaC Module Specification Template (OpenTofu, Terraform)
전체One reusable IaC module: inputs and outputs, guardrails, security baseline, tagging contract, SemVer rules, tests and policy as code, deprecation
SemVer 2.0.0; OpenTofu 1.13 and Terraform 1.17 module and test conventions
정책
Branching Strategy Template (Trunk-Based, SLSA Source)
전체Branching standard: model selection, naming, MUST/SHOULD rules, ruleset settings, SLSA Source mapping, merging, release branches, hotfixes, exceptions, metrics
SLSA 1.2 Source track; DORA trunk-based development; Conventional Commits 1.0.0Versioning and Release Policy Template (SemVer, CalVer, CRA)
전체Versioning policy: SemVer or CalVer rules, release types and cadence, changelog conventions, support tiers, LTS, CRA support period, backports, yanking
SemVer 2.0.0; CalVer 26.0; Conventional Commits 1.0.0; Keep a Changelog 1.1.0; CRA Art. 13(8)-(11)Feature Flag Policy Template (OpenFeature)
전체Feature flag standard: flag types and lifetimes, naming, metadata, lifecycle, rollout stages, kill switches, change control, testing, privacy, flag debt
OpenFeature specification v0.9.0Dependency Management Policy Template (SSDF, Scorecard)
전체Dependency policy: tiers, intake scoring, approved sources, lock files and SHA pinning, cooldown, update targets, malicious packages, licences, forks, metrics
NIST SP 800-218 SSDF 1.1 PW.4; OpenSSF Scorecard v5; OSPS Baseline v2026.08.28Code Ownership Policy Template (CODEOWNERS)
전체Code ownership policy: ownership models, RACI, MUST/SHOULD rules, CODEOWNERS standard and example, review SLAs, escalation, orphaned code, transfers, metrics
GitHub and GitLab code owners documentation; SLSA 1.2 Source track
릴리스와 이관
Software Release Checklist Template (Staged Rollout, SBOM, VEX)
전체Per-release checklist: planning and pre-mortem, freeze, QA, security, 2026 SBOM fields, VEX and advisories, signing, ring rollout, emergency rollback, sign-offs
CISA Safe Software Deployment (2024); CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1Deployment and Release Runbook Template
표준Deployment runbook: release metadata, pre-deploy checklist, go/no-go, steps with verification, canary rollout, rollback, comms
Changelog Template (Keep a Changelog)
표준Keep a Changelog + SemVer
Keep a ChangelogRelease Notes Template
표준Release notes: highlights, features, fixes, breaking changes with migration, deprecations with deprecation and sunset dates, CVE fixes, known issues, upgrade steps
Semantic Versioning 2.0.0; RFC 9745 and RFC 8594 headers