Delivery Pipelines
CI/CD that understands governance states.
Standard CI/CD tools can call APIs. DecisionManager pipelines know the governance lifecycle — a deploy step fails if the ruleset isn't in `approved` state. No bypass, no accident.
Pipeline stages (Live)
| stage | What it does |
|---|---|
| validate | Compile / vocabulary type check / schema conformance (optional requireVocabulary) |
| analyse | Gaps, overlaps, unreachable rules with per-finding severity |
| test | Ruleset test suites and optional scenario sets; fails closed if empty unless allowEmpty |
| replay | Replays recorded production decisions against the candidate; tolerance on changed % |
| index_check | Index / residual-rules health check before promotion |
| gate | Quality / governance gate — fail-closed; no warn-and-continue |
| deploy | Promote to Decision Server environment; mutating stage |
| verify | Post-deploy verification — fail-closed after deploy |
Example: full release pipeline
apiVersion: pipeline/v1
name: loan-eligibility-release
environment: prod
triggers:
- on: api
stages:
- stage: validate
requireVocabulary: true
- stage: analyse
- stage: test
suites: all
- stage: replay
source: { kind: random, sample: 2000, seed: "release" }
tolerance: { maxChangedPct: 0.5 }
- stage: gate
- stage: deploy
- stage: verify
# notifications are top-level on PipelineDef — not a stage namedm CLI integration
Trigger and block
dm pipeline run \ --pipeline loan-eligibility-release \ --ruleset <id> --wait
Blocks until terminal. Exit 0 only when status is passed; non-zero codes are frozen by class (validate/test/gate/deploy/…). See dm exit-codes and docs/operations/CI-COOKBOOK.md.
GitHub Actions step
- name: Run release pipeline
run: dm pipeline run \
--pipeline ${{ vars.PIPELINE_ID }} \
--ruleset ${{ vars.RULESET_ID }} \
--version ${{ steps.publish.outputs.version_id }}
env:
DM_API_KEY: ${{ secrets.DM_API_KEY }}The CLI prints the run URL at the end — post it as a PR comment or deployment annotation.
Governance is enforced at the deploy step
The deploy step calls the Decision Server's hot-deploy endpoint, which requires approved state. A draft or in-review version fails the step — no live traffic is affected. A pipeline cannot accidentally deploy an ungoverned version to production.