UBC — AI Solutions

Audit — Dynamic Documentation Platform

Living documentation that stays in sync with engineering, cloud, AI, and compliance activity. Documents update themselves as the organization changes.

Back to library
SOP
Fresh

SOP-SDLC-04 — Build, CI/CD & Release Management

Governs how UBC builds, packages, signs, and promotes software through CI/CD.

Owner: Release ManagerApprover: Engineering DirectorVersion: 3.7Updated: 12/17/1969

1. Purpose

Produce trustworthy build artefacts and promote them through environments in a controlled manner.

2. Scope

All application, service, and infrastructure builds.

3. Definitions

  • Artefact — A signed, immutable, versioned output of a build.
  • Environment — Named deployment target (dev, staging, prod).

4. Roles & Responsibilities (RACI)

ActivityRACICadence
Configure pipelinePlatform EngRelease ManagerTeamEngineeringPer pipeline change
Cut releaseRelease ManagerEngineering DirectorPMOStakeholdersPer release train
Sign & attest artefactPipeline (Sigstore)Release ManagerSecurityTeamEvery build

5. Procedure

  1. Every commit to main triggers a full CI run: lint, unit tests, SAST, container scan, SBOM.
  2. Artefacts are signed with Sigstore and stored in the artefact registry with provenance metadata (SLSA Level 3).
  3. Promotion to staging requires green CI and PR merge; promotion to prod requires Release Manager approval and a change record.
  4. Release notes are auto-generated from merged PRs and attached to the release.

6. Inputs & Outputs

Inputs

  • Merged PRs
  • Pipeline configuration
  • Environment inventory

Outputs

  • Signed artefacts
  • SBOM
  • Release notes
  • Change records

7. Controls & Metrics

MetricTarget
Signed artefacts in prod100%
Mean lead time (commit → prod)≤ 24h

8. Exceptions & Escalation

  • Hotfixes may skip staging with two-executive approval, subject to full CI.

9. Records & Retention

RecordRetention
Build logs & artefacts3 years
Change records7 years

10. Related Documents

  • SOP-SDLC-06
  • SOP-SDLC-07
  • SOP-CMMI-CM

11. References

  • SLSA v1.0
  • CMMI PI
  • SOC 2 CC8.1

12. Revision History

See the Versions tab for the full change history maintained by the Auto-Doc Engine.

Document code: SOP-SDLC-04 · Aligned to CMMI-DEV PI / SLSA Level 3. Controlled document — reproduction outside the UBC QMS requires the Quality Manager's approval.

Suggested by AI
No suggestions right now.
Frameworks
CMMI-DEV
ISO 9001
SOC 2