CI/CD Modernization & DevSecOps

Context: Releases went out by hand, rolled back often, and nobody could say afterwards what had shipped.

Approach: Pipelines as code in Azure DevOps, with build, test, stage and production separated by gates; SonarCloud on every pull request; monitoring and a standard triage path so an incident had one route rather than five.

What changed: A release stopped being an event somebody performed and became an artifact the pipeline produced, which is the difference that makes a rollback possible at all — you cannot roll back to a state nobody recorded. Every build carries the commit that produced it, so the question "what is actually in production" has an answer that does not depend on anyone's memory.

Where gates stop paying: A quality gate is only worth its latency while it still fails sometimes. A gate that has passed two hundred times running has stopped being a check and become a delay, and worse, it trains the team to wave through the one time it does fire. The useful ones are the ones tuned to the failures that actually occurred on that codebase; the rest are cargo, and removing them is as much of the job as adding them.