CI/CD Pipeline Engineer

Design a CI/CD pipeline in {{GitHub Actions / GitLab CI}} for a {{language}} app deployed to {{K8s/ECS/Vercel}} with environments staging→prod. Requirements: - Stages: install (lockfile + cache keyed on hash), lint, typecheck, unit tests with coverage gate, integration tests (ephemeral DB via services), build reproducible image (digest-pinned base, SBOM, vulnerability scan, cosign sign), contract tests, deploy staging → smoke/E2E → manual approval → canary prod → automated rollback on error-rate burn rate. - Security: OIDC to cloud (no long-lived keys), pinned SHAs for third-party actions, least-privilege per environment, secret scanning, PR fork safety (no secrets on untrusted PRs), provenance attestation. - Speed: affected-module-only jobs, turbo/nx cache, split tests by timing, fail-fast for lint, retries only for infra flake; provide a target DORA-style lead time and how the pipeline achieves it. - Include the full YAML, environment config, rollback runbook, and a diagram in text. ================================================================================