Skip to main content

Common Pipeline Stages

Table of Contents

What do the stages do?

Depending on configuration and other factors each Jenkins pipeline will have a number of stages and each stage will perform some specific task (or number of tasks) - most will run sequentially one after another but there are some which will run in parallel (for example performance tests).

The same stage may run multiple times at different points in the flow but against different environment. As described in Jenkins agents such stage will be environment-constrained, this means that it will execute on a Jenkins Agent dedicated to that specific environment to maintain appropriate access controls.

Code changes are subjected to a round of static tests - consisting of unit tests, static code analysis and security checks - before being deployed to a non-prod environment in a non-publicly accessible AKS (Kubernetes) deployment.

Here, a range of smoke tests and non-destructive functional tests verify that the app is functioning.

At this point a promotion process is started which labels the Docker image produced by the previous stages of the pipeline as production-ready.

Production deployments are managed by flux which takes care of keeping an application deployment up to date with the latest production-ready image generated by the delivery pipeline.

Smoke tests are available in production as part of a flux deployment and run from a separate container.

Types of stages

---
config:
    theme: base
    flowchart:
        nodeSpacing: 40
        padding: 10
        rankSpacing: 10
        diagramPadding: 40
        useMaxWidth: true
        curve: step
        wrappingWidth: 180
    themeVariables:
        fontSize: 18px
---
flowchart LR
    subgraph mandatoryStages[Default / Mandatory Stages]
        direction LR
        subgraph legend[Legend]
            direction LR
            mandatory[Stages that run by default or are mandatory]
            deploymentOnly[Stages only available if deployment enabled]
            optional[Stages that can be optionally enabled with config]
            note[* Note - diagram is a simplified visualisation of the pipeline code and represents mostly sequential order, stage dependencies and conditional logic may be more nuanced]
        end
        checkout ~~~ legend
        checkout[Checkout] --> acrMigration[ACR Migration Check]
        acrMigration --> build[Build]
        build --> staticChecks[Static Checks / Container Build]
        subgraph buildSteps[ Build steps / testing ]
            unitTests[Unit Tests and Sonar Scan]
            techMaintenance[Tech Stack Maintenance]
            dockerBuild[Docker Build]
        end
        staticChecks --> unitTests
        staticChecks --> techMaintenance
        staticChecks --> dockerBuild
        subgraph securityChecksStages[ Security checks ]
            direction LR
            javaOwasp[Java OWASP dependency check]
            nodejsYarnAudit[NodeJS Yarn audit]
            pythonUvAudit[Python UV audit]
        end
        staticChecks --> javaOwasp
        staticChecks --> nodejsYarnAudit
        staticChecks --> pythonUvAudit
        subgraph optionalSteps["Optional steps"]
            direction LR
            subgraph dockerTestStage[Jenkinsfile,Master,Java only]
                dockerTest[Docker Test Build]
                releaseOnMerge[Create GitHub Release on merge]
            end
            subgraph fortifyScanStage[Via PR Label / Jenkinsfile]
                fortifyScan[Fortify Scan]
            end
            subgraph pactVerificationStage[Via Jenkinsfile]
                pactVerification[Pact Consumer verification]
            end
        end
        staticChecks --> dockerTest
        staticChecks --> releaseOnMerge
        staticChecks --> fortifyScan
        subgraph deploymentMustBeEnabled[ Deployment-enabled only stages]
            direction LR
            promoteDockerImage[Promote Docker Image] --> pactVerification
            pactVerification --> buildInfrastructureAAT
            buildInfrastructureAAT --> planTFComponentAAT
            planTFComponentAAT --> applyTFComponentAAT
            applyTFComponentAAT --> flywayDbMigrationAAT
            subgraph optionalDeploymentEnabledSteps[ Opt-in steps]
                subgraph flywayDbMigrationAATStage[Via Jenkinsfile, Java only]
                    flywayDbMigrationAAT["Db Migration - AAT/Staging (Flyway)"]
                end
                subgraph flywayDbMigrationProdStage[Via Jenkinsfile, Java only]
                    flywayDbMigrationProd["Db Migration - Prod (Flyway)"]
                end
                subgraph optionalViaJenkinsFile[Via Jenkinsfile]
                    highLevelDataSetupAAT[High Level Data Setup - AAT/Staging]
                    pactConsumerCanIDeploy[Pact Consumer Can I Deploy]
                    pactProviderVerification[Pact Provider Verification]
                        e2eTestAAT[ E2E Test - AKS ]
                        crossBrowserTestAAT[ Cross-browser Test ]
                        mutationTestAAT[ Mutation Test ]
                    highLevelDataSetupProd[High Level Data Setup - Prod]
                    apiGatewayTests[API Gateway Tests]
                    zapSecurityScan[ZAP Security Scan]
                    performanceTests[Performance Tests]
                    branchesToSyncWithProd["Branches to Sync (list of branches to sync with Prod)"]
                    subgraph optionalPerformanceTests[ Optional performance tests ]
                        dynatracePerformanceSetupAAT[Dynatrace Performance Setup]
                        dynatraceSyntheticTestsAAT[Dynatrace Synthetic Tests]
                        gatlingLoadTestsAAT[Gatling Load Tests]
                        srgEvaluationAAT[Site Reliability Guardian Evaluation]
                    end
                end
                subgraph optionalInfrastructure[Infrastructure directory exists]
                    buildInfrastructureAAT[Build infrastructure - AAT/Staging]
                    planTFComponentAAT["Plan component in AAT/Staging (TF)"]
                    applyTFComponentAAT["Apply component in AAT/Staging(TF)"]
                    buildInfrastructureProd[Build Infrastructure - Prod]
                    planTFComponentProd["Plan component in Prod (TF)"] 
                    applyTFComponentProd["Apply component in Prod (TF)"]
                end
                flywayDbMigrationAAT --> highLevelDataSetupAAT
            end
            highLevelDataSetupAAT --> aksDeployAAT[AKS Deploy - AAT]
            aksDeployAAT --> pactConsumerCanIDeploy
            pactConsumerCanIDeploy --> pactProviderVerification
            pactProviderVerification --> smokeTestAKSAAT[Smoke Test AKS - AAT]
            smokeTestAKSAAT --> apiGatewayTests
            apiGatewayTests --> functionalTestAAT[Functional Test / Full Functional Test - AAT]
            functionalTestAAT --> performanceTests
            performanceTests --> zapSecurityScan
            zapSecurityScan --> dynatracePerformanceSetupAAT
            dynatracePerformanceSetupAAT --> dynatraceSyntheticTestsAAT
            dynatracePerformanceSetupAAT --> gatlingLoadTestsAAT
            dynatraceSyntheticTestsAAT --> srgEvaluationAAT
            gatlingLoadTestsAAT --> srgEvaluationAAT
            srgEvaluationAAT --> crossBrowserTestAAT
            crossBrowserTestAAT --> mutationTestAAT
            mutationTestAAT --> e2eTestAAT
            e2eTestAAT --> uninstallHelmRelease[Uninstall Helm Release]
            uninstallHelmRelease --> publishHelmChart[Publish Helm Chart]
            publishHelmChart --> buildInfrastructureProd
            buildInfrastructureProd --> planTFComponentProd
            planTFComponentProd --> applyTFComponentProd
            applyTFComponentProd --> flywayDbMigrationProd
            flywayDbMigrationProd --> highLevelDataSetupProd
            highLevelDataSetupProd --> productionBuildPromotion[Production build promotion]
            productionBuildPromotion --> branchesToSyncWithProd
        end
        staticChecks --> promoteDockerImage
    end



style mandatoryStages fill:#f7f9ff,stroke:#cfdbf3,stroke-width:10px,stroke-dasharray: 20
style buildSteps fill:none,stroke:#cfdbf3,stroke-width:5px,stroke-dasharray: 20
style securityChecksStages fill:#00000,stroke:#cfdbf3,stroke-width:5px,stroke-dasharray: 20

style optionalSteps fill:#9fc08f,stroke:#488f31,stroke-width:2px,stroke-dasharray: 20
style dockerTestStage fill:#d5e0cf,stroke:#488f31,stroke-width:2px,stroke-dasharray: 20
style fortifyScanStage fill:#d5e0cf,stroke:#488f31,stroke-width:2px,stroke-dasharray: 20
style pactVerificationStage fill:#d5e0cf,stroke:#488f31,stroke-width:2px,stroke-dasharray: 20

style deploymentMustBeEnabled fill:#f0b8b8,stroke:#ff5f66,stroke-width:5px,stroke-dasharray: 20
style optionalDeploymentEnabledSteps fill:#9fc08f,stroke:#488f31,stroke-width:5px,stroke-dasharray: 20
style flywayDbMigrationAATStage fill:#d5e0cf,stroke:#488f31,stroke-width:5px,stroke-dasharray: 20
style optionalInfrastructure fill:#d5e0cf,stroke:#488f31,stroke-width:5px,stroke-dasharray: 20
style optionalViaJenkinsFile fill:#d5e0cf,stroke:#488f31,stroke-width:5px,stroke-dasharray: 20
style flywayDbMigrationProdStage fill:#d5e0cf,stroke:#488f31,stroke-width:5px,stroke-dasharray: 20
style optionalPerformanceTests fill:#d5e0cf,stroke:#488f31,stroke-width:2px,stroke-dasharray: 0

style legend fill:white,stroke:#cfdbf3,stroke-width:5px,stroke-dasharray: 0
class mandatory legendMandatory
class optional optional
class deploymentOnly deploymentOnly
classDef legendMandatory fill:#f7f9ff,stroke:#cfdbf3,stroke-width:5px,stroke-dasharray: 20
classDef optional fill:#9fc08f,stroke:#488f31,color:whitstroke-width:5px,stroke-dasharray: 20
classDef deploymentOnly fill:#f0b8b8,stroke:#ff5f66,stroke-width:5px,stroke-dasharray: 20


classDef allNodes fill:white,stroke:#ffa600,stroke-width:3px
class checkout,acrMigration,build,staticChecks allNodes
class unitTests,techMaintenance,dockerBuild allNodes
class javaOwasp,nodejsYarnAudit,pythonUvAudit allNodes
class dockerTest,releaseOnMerge,fortifyScan,pactVerification allNodes
class promoteDockerImage allNodes
class buildInfrastructureAAT,planTFComponentAAT,applyTFComponentAAT allNodes
class buildInfrastructureProd,planTFComponentProd,applyTFComponentProd allNodes
class flywayDbMigrationAAT,flywayDbMigrationProd allNodes
class highLevelDataSetupAAT,highLevelDataSetupProd allNodes
class pactConsumerCanIDeploy,pactProviderVerification allNodes
class e2eTestAAT,crossBrowserTestAAT,mutationTestAAT allNodes
class apiGatewayTests,zapSecurityScan,performanceTests allNodes
class dynatracePerformanceSetupAAT allNodes
class dynatraceSyntheticTestsAAT,gatlingLoadTestsAAT,srgEvaluationAAT allNodes
class aksDeployAAT,smokeTestAKSAAT,functionalTestAAT allNodes
class uninstallHelmRelease,publishHelmChart allNodes
class productionBuildPromotion,branchesToSyncWithProd allNodes

Figure 1 - Simplified flow diagram of all top-level stages (click to zoom and pan)

There are broadly three categories of stages within the Common Pipeline:

  • Default stages - these are always enabled even if your repository has not been added to the list of deployment-enabled repositories. These are mostly build related (e.g. static checks) and do not allow actual deployment or promotion.
  • Optional stages - these will fall anywhere within the flow (as evident on the diagram in Figure 1) and are usually disabled by default. Most are enabled either via a configuration in a Jenkinsfile, a specific branch or environment, a Pull Request label or a combination of all of these. They may also require additional conditions to be met, refer to cnp-jenkins-library README for more details.
  • Deployment-enabled only stages - some stages in this category may also be thought as belonging to the either of the other two categories but only become available once the repository has been added to the whitelist of deployment-enabled repositories in CFT or SDS.

Mandatory and conditional stages

Stages below form the standard application delivery path. Those marked as conditional are part of the pipeline implementation but only run when their branch, repository, or deployment conditions are met.

Stage Status What it does
Checkout Mandatory Checks out the application source.
ACR Migration Check Mandatory Checks for outdated Azure Container Registry references.
Build Mandatory for buildable applications Builds the application using the configured language builder.
Static checks / Container build Mandatory Groups unit tests, Sonar scan, security checks, technology-stack maintenance, and Docker build where applicable.
Unit tests and Sonar scan Mandatory within static checks Runs the application tests and Sonar quality gate.
Security Checks Mandatory within static checks Runs the application dependency or security checks.
Tech Stack Mandatory within static checks Runs technology-stack maintenance checks.
Docker Build Conditional Runs when the repository contains a Dockerfile.
Terraform Plan / Build Infrastructure Conditional Runs when the repository contains an infrastructure directory. Pull requests run plans; deployment branches build the infrastructure.
Promote Docker Image Conditional Retags the built image for the target deployment stage.
AKS deploy Conditional Installs or upgrades the application Helm release in Preview, AAT, Production, or another configured environment.
Smoke Test Conditional Runs non-destructive smoke tests after an AKS deployment for service applications.
Functional Test Conditional Runs functional tests in configured functional-test environments.
Publish Helm chart Conditional Publishes the Helm chart for Preview and the master deployment path.
Prod build promotion Conditional Promotes the image to the production tag and reconciles the Flux image repository after production verification.
Branch synchronisation Conditional Synchronises configured branches after the master deployment path.

Many stages are environment-specific so one Jenkins run may create multiple instances such as AKS deploy - preview, AKS deploy - aat, and AKS deploy - prod, refer to Figure 1 diagram for a basic example of this.

Developer-enabled / optional stages

Following stages are disabled by default but can be optionally enabled. Refer to cnp-jenkins-library for more details and up-to-date examples

Stage or capability Library definition
API gateway tests Runs after smoke tests. The application must provide the apiGateway task.
E2E tests Runs on master after deployment; can also be requested on a pull request with the enable_e2e_test label.
Cross-browser tests Runs on master after deployment. A browser list can be supplied to run selected browsers.
Mutation tests Runs on master after deployment.
Full functional tests Uses the full functional test implementation instead of the standard functional test in the relevant path.
Performance test Enables the application performance test hook. A pull request can request it with the enable_performance_test label.
Security scan Enables the deployed-application security scan. A pull request can request it with the enable_security_scan label.
Fortify scan Adds Fortify to the static checks stage; a pull request can request it with the enable_fortify_scan label.
Docker test build Adds the test image build for supported Java applications on master.
High Level Data Setup Adds data setup stages for the applicable environments. Production can be skipped with its second argument.
Database migration Adds the DB Migration - ENV stage when infrastructure is applied. This is currently only applicable to Java / Gradle and runs Flyway migrations.
Pact Consumer Verification Verifies consumer contracts when Pact consumer testing is enabled.
Pact Consumer Can I Deploy Checks whether a consumer can deploy when the Pact deploy check is enabled.
Pact Provider Verification Verifies provider contracts when Pact provider testing is enabled.
Release on merge Creates a GitHub release on master when the Gradle version has advanced.
Dynatrace synthetic tests Adds performance setup and Dynatrace synthetic test stages in Preview, AAT, or perftest by default.
Gatling load tests Adds an external Gatling load-test stage. The repository parameter is required.
Site Reliability Guardian evaluation Evaluates performance-test results; failure behaviour can be warn, fail, or ignore.
This page was last reviewed on 10 September 2026. It needs to be reviewed again on 10 March 2027 by the page owner platops-build-notices .