ICT-Platform Dev Specialist FA: Development Lifecycle, Testing, and Governance

Development Lifecycle, Testing, and Governance tests how changes reach production safely and provably: pipelines, test strategy, review, supply chain, and the audit evidence platform consumers and regulators expect.

Pipeline and branching

• Trunk-based development with branches under a day reduces merge risk; feature flags hide incomplete work instead of long-lived branches.
• Every merge runs build, unit, contract, and security scans. Artifacts are built once, signed, and promoted by digest through environments.
• Environments are ephemeral and reproduced from code; production is not hand-tuned.

Test strategy

• Test pyramid: many fast unit tests, fewer service/integration tests against real dependencies in containers, very few end-to-end tests.
• Consumer-driven contract tests catch interface breakage far cheaper than E2E and run in both providers' and consumers' pipelines.
• Coverage is a diagnostic, not a target: a covered line with no assertion proves nothing.
• Test failure paths - timeouts, partial writes, duplicate delivery, rollback - not only the happy path.

Governance and supply chain

• Peer review with required approvals, protected main branches, signed commits where policy demands.
• An SBOM per build, dependency and container scanning gating on critical CVEs, and base images rebuilt on a schedule.
• Policy as code (admission rules) enforces tagging, resource limits, and no latest tags.
• Change records and deploy logs form the audit trail; DORA metrics - lead time, deploy frequency, change failure rate, MTTR - measure the process, not individuals.

Worked example

A team needs a breaking API change. Governance path: version the endpoint (/v2), publish the OpenAPI diff, run consumer-driven contract tests for known consumers, announce deprecation with a Sunset header date, watch v1 traffic fall to zero, then remove v1. Reasoning: the contract test fails in CI the moment a consumer's expectation breaks, which is far cheaper than a customer-discovered production incident, and the traffic metric is the objective evidence that removal is safe.

Traps

• Long-lived release branches merged quarterly.
• Manual approval as the only quality gate.
• Chasing 100% coverage while untested failure paths ship.
• Treating the SBOM as a one-time document.
• Deploying a rebuilt artifact instead of promoting the one that was tested.