OpsUnity — internal platform · Platform engineering
A pipeline template library that removed copy-paste delivery
47 reusable pipeline templates under semantic versioning, a single version contract from package to container to Helm chart, and a self-audit that found the documented standard had zero compliance.
- 47
- Reusable templates in the library
- 3-tier
- Composition: steps, jobs, stages
- 1
- Version contract from commit to running pod
- 0 of 7
- Consumers compliant at first audit
The challenge
Pipeline logic duplicated per repository drifts immediately, and a fix has to be found in every copy. Two further problems compounded it: nobody could say with certainty which build was running in production, and repeated feature-branch publishes collided with an immutable artifact feed.
Our approach
Delivery logic was consolidated into a versioned library composed in three tiers — steps into jobs into stages — released under semantic versioning with a maintained changelog. A single version contract makes the package version, container image tag and Helm chart version provably identical. Pre-release builds publish uniquely suffixed versions under a separate dist-tag, so feature branches can publish without limit while stable consumers are untouched.
The most useful outcome was not the library. It was auditing our own compliance against it.
The documented standard required every consumer to pin templates to a released tag. Checking that against live API state found zero of seven compliant — stale tags, floating branch references, missing refs entirely, and one production pipeline pinned to a feature branch that could have been deleted at any moment.
The fix was not a better document
It was a validation step that fails any build whose template reference is not a tag. A standard nothing enforces is a suggestion, and the gap between what teams document and what they actually do is invisible until something measures it.
Transferable lessons
- Pin shared templates to tags, and enforce it in CI rather than in a wiki
- Make the version contract explicit so any deployed artefact traces to an exact commit
- Audit your own standards on a schedule — compliance decays silently
- Solve pre-release publishing before teams work around it with manual version bumps
Facing something similar?
Tell us where your infrastructure hurts. We'll show you the pipeline out.