What they're testing
Whether you think about team behaviour — a slow or flaky pipeline gets routed around one way or another.
The short answer~30 seconds
Non-negotiable: lint and type-check, unit tests, build, dependency vulnerability scan, and automatic deployment to staging. The time target is under ten minutes for pull-request feedback — beyond that people start batching changes into bigger PRs to avoid waiting, and you lose the point of CI. Slow integration tests should run in parallel or post-merge rather than blocking the PR.
The long answer
Order the steps to fail early and cheaply: lint first (seconds), types (tens of seconds), unit tests (minutes), then build and integration tests. Parallelise anything independent. A pipeline that builds before linting makes a developer wait three minutes to learn about a missing semicolon.
The biggest practical problem isn't speed but flaky tests. A test that fails randomly 2% of the time sounds minor, but across 200 tests nearly every PR goes red at least once, and the team learns to hit retry without reading. From that point the pipeline is no longer a signal. The remedy is tracking flakiness as a metric, quarantining flaky tests out of the blocking path, and fixing or deleting them — not adding automatic retries.
On security in the pipeline, two things are worth doing early because they're cheap: dependency scanning (npm audit, Dependabot, Trivy for container images) and secret scanning on commits. Both cost almost no time and catch a class of mistake code review doesn't. Deeper static analysis usually runs on a schedule rather than blocking PRs, being slow and noisy.
What they'll ask next
?Automatic production deploys or a human gate?
It depends on test confidence and rollback speed. If rollback takes 30 seconds and the tests are good, automatic is reasonable and lowers risk because each deploy is smaller. If rollback is hard, a human gate makes sense — but it has to be a decision, not a button pressed by habit.
These lose points
- Auto-retrying failed tests. You've converted a signal into authoritative-looking noise.
- No automatic staging deploy. If staging is deployed by hand, it will always drift from production.