Readiness Checks - Geert Theys

CI/CD Health Check Scorecard

Score your pipeline in 10 minutes

Answer each question honestly. Score yourself 0 (no / never), 1 (partially / sometimes), or 2 (yes / always). Add up your total at the end.

Build & Test

1. Can you build and test your application with a single command?

0 1 2

2. Does your build complete in under 15 minutes?

0 1 2

3. Do you have automated tests that run on every commit?

0 1 2

4. Do your tests cover critical business logic, not just happy paths?

0 1 2

5. Can a new developer run the full test suite locally on day one?

0 1 2

Deployment

6. Can you deploy to production in under 1 hour from merge?

0 1 2

7. Do you deploy at least once per week?

0 1 2

8. Is your deployment process fully automated (no manual steps)?

0 1 2

9. Can you roll back a deployment in under 10 minutes?

0 1 2

10. Do you have a staging environment that accurately reflects production?

0 1 2

Process & Culture

11. Is your pipeline configuration version-controlled and reviewed like code?

0 1 2

12. Does every developer on the team understand how the pipeline works?

0 1 2

13. Do you have monitoring and alerting on your pipeline itself (not just the application)?

0 1 2

14. When the pipeline breaks, is it fixed within 1 hour?

0 1 2

15. Do you have documented runbooks for deployment failures?

0 1 2

Agentic Workflow Readiness Scorecard

Is your team ready for AI-assisted development?

Same scoring. 0 (no / never), 1 (partially / sometimes), 2 (yes / always).

Foundation

1. Do you have written coding standards that your team actually follows?

0 1 2

2. Do you write specs or design docs before starting implementation?

0 1 2

3. Does every PR go through a human code review before merge?

0 1 2

4. Do you have automated tests that are written independently from the code they test?

0 1 2

5. Is your codebase well-documented enough that a new team member can contribute within a week?

0 1 2

AI Readiness

6. Do you have clear guidelines on when and how AI coding tools should be used?

0 1 2

7. Can your team distinguish between AI-generated code and human-written code in reviews?

0 1 2

8. Do you audit AI-suggested dependencies before adding them?

0 1 2

9. Do you have a process to validate that AI-generated tests actually test behaviour, not just implementation?

0 1 2

10. Do you track which parts of your codebase were AI-generated vs human-written?

0 1 2

Security & Governance

11. Do you scan AI-generated code for known vulnerability patterns?

0 1 2

12. Are secrets and credentials managed in a way that prevents them from appearing in AI context windows?

0 1 2

13. Do you have policies on what data can be sent to external AI APIs?

0 1 2

14. Can you explain to a regulator or auditor how AI is used in your development process?

0 1 2

15. Do you have an incident response process specifically for AI-related code failures?

0 1 2