Markdown Editor
Mở trình soạn thảo

Bộ mẫu chuyển giao phần mềm

Thiết kế pipeline CI/CD, module IaC và golden path, chính sách nhánh, phiên bản, feature flag, phụ thuộc và sở hữu mã, phát hành và chỉ số DORA.

Bước 1

Nền tảng và khả năng vận hành

  1. Platform Golden Path Specification Template

    Chuẩn

    Golden path spec: target users, stack, scaffolding, CI/CD, environments, observability and security defaults, Backstage catalog

  2. CI/CD Pipeline Design Template (SLSA, NIST SP 800-204D)

    Đầy đủ

    CI/CD design: stages and gates, environments and promotion, OIDC secrets, SBOM and provenance, rollout and rollback, CICD-SEC review, DORA metrics, traceability

    NIST SP 800-204D; NIST SP 800-218 SSDF 1.1; SLSA 1.2; OWASP Top 10 CI/CD Security Risks

  3. IaC Module Specification Template (OpenTofu, Terraform)

    Đầy đủ

    One reusable IaC module: inputs and outputs, guardrails, security baseline, tagging contract, SemVer rules, tests and policy as code, deprecation

    SemVer 2.0.0; OpenTofu 1.13 and Terraform 1.17 module and test conventions
Bước 2

Chính sách

  1. Branching Strategy Template (Trunk-Based, SLSA Source)

    Đầy đủ

    Branching standard: model selection, naming, MUST/SHOULD rules, ruleset settings, SLSA Source mapping, merging, release branches, hotfixes, exceptions, metrics

    SLSA 1.2 Source track; DORA trunk-based development; Conventional Commits 1.0.0

  2. Versioning and Release Policy Template (SemVer, CalVer, CRA)

    Đầy đủ

    Versioning policy: SemVer or CalVer rules, release types and cadence, changelog conventions, support tiers, LTS, CRA support period, backports, yanking

    SemVer 2.0.0; CalVer 26.0; Conventional Commits 1.0.0; Keep a Changelog 1.1.0; CRA Art. 13(8)-(11)

  3. Feature Flag Policy Template (OpenFeature)

    Đầy đủ

    Feature flag standard: flag types and lifetimes, naming, metadata, lifecycle, rollout stages, kill switches, change control, testing, privacy, flag debt

    OpenFeature specification v0.9.0

  4. Dependency Management Policy Template (SSDF, Scorecard)

    Đầy đủ

    Dependency policy: tiers, intake scoring, approved sources, lock files and SHA pinning, cooldown, update targets, malicious packages, licences, forks, metrics

    NIST SP 800-218 SSDF 1.1 PW.4; OpenSSF Scorecard v5; OSPS Baseline v2026.08.28

  5. Code Ownership Policy Template (CODEOWNERS)

    Đầy đủ

    Code ownership policy: ownership models, RACI, MUST/SHOULD rules, CODEOWNERS standard and example, review SLAs, escalation, orphaned code, transfers, metrics

    GitHub and GitLab code owners documentation; SLSA 1.2 Source track
Bước 3

Phát hành và chuyển giao

  1. Software Release Checklist Template (Staged Rollout, SBOM, VEX)

    Đầy đủ

    Per-release checklist: planning and pre-mortem, freeze, QA, security, 2026 SBOM fields, VEX and advisories, signing, ring rollout, emergency rollback, sign-offs

    CISA Safe Software Deployment (2024); CISA 2026 SBOM Minimum Elements; NIST SSDF 1.1

  2. Deployment and Release Runbook Template

    Chuẩn

    Deployment runbook: release metadata, pre-deploy checklist, go/no-go, steps with verification, canary rollout, rollback, comms

  3. Changelog Template (Keep a Changelog)

    Chuẩn

    Keep a Changelog + SemVer

    Keep a Changelog

  4. Release Notes Template

    Chuẩn

    Release notes: highlights, features, fixes, breaking changes with migration, deprecations with deprecation and sunset dates, CVE fixes, known issues, upgrade steps

    Semantic Versioning 2.0.0; RFC 9745 and RFC 8594 headers
Bước 4

Đánh giá tác động

  1. Software Delivery Performance Report Template (DORA Metrics)

    Đầy đủ

    Quarterly DORA five-metric report per service, definitions and formulas, data quality, capability assessment, survey data, findings, actions

    DORA metrics guide (2026-01-05); DORA capabilities; SPACE 2021; DevEx 2023