A golden pipeline is a single, centrally owned build and deploy definition that teams call instead of writing their own. It bakes in the security steps you want everywhere: dependency scan, secret scan, build outputs, and a deploy gate. Teams supply inputs such as language and service name, not the steps.
Definition and why platform teams build one
Without a shared template, every repository drifts. One team skips the scan, another pins nothing, a third copies a workflow from a blog post. A golden pipeline (also called a paved road pipeline or a shared template) moves those decisions to one place. When you change the template, every caller picks up the change.
In GitHub Actions this is usually a reusable workflow. The official docs describe calling one with jobs.<job_id>.uses, and note that a reusable workflow can hold multiple jobs and use secrets. Other CI systems have equivalents, such as shared libraries or includes.
What belongs in the golden path
| Stage | Include | Why central |
|---|---|---|
| Checkout and setup | Pinned actions or images, read only token | Removes the most common supply chain slip |
| Dependency scan | SCA with a consistent policy | Same severity rules everywhere |
| Secret scan | Diff scan on every change | Cheap, fast, high value |
| Build | Reproducible build, SBOM output | Evidence for audits and customers |
| Deploy gate | Block on agreed findings, protected environment | One enforcement point |
What to leave to teams
Do not centralise everything. Teams should own unit tests, language specific linting, and their own deploy targets. If the template tries to cover every case, people fork it, and the benefit disappears. Offer a few typed inputs, and a documented extension point for extra steps that run after the standard ones.
Steps to build the first version
- Pick two or three services with different languages and copy their current pipelines side by side.
- List the steps they share and the steps you wish they shared.
- Write the template with the shared steps and a small set of inputs.
- Run it in report mode on a pilot repo, so findings are visible but nothing blocks.
- Publish a versioned tag, document the inputs, and move pilot teams over.
- Switch the gate to enforce once the findings are triaged.
Common failure modes
The template becomes a bottleneck when only one person can change it. Put it behind a CODEOWNERS rule with at least two owners from the platform team. It also fails when changes land on a moving branch and break callers at once, so cut tagged releases and let callers upgrade on a schedule.
Try it yourself
Open the demo and click through the pull request gate to see where a shared check sits in the flow and what a blocked change looks like.
Click through it at your own pace, or open it full screen.
Quick check
Is a golden pipeline the same as a platform engineering portal?
No. A portal is where developers discover and request things. A golden pipeline is the automation they run. The two work well together because a portal template can create a repo that already calls the pipeline.
Should the golden pipeline be mandatory?
Make it the easy default first. Make it required for production deploys once it covers the common cases, and give teams a documented exception route.
Safeguard can scan dependencies, produce SBOMs and enforce policy gates from a pipeline step, and you can try a free scan at gold.safeguard.sh/scan.
Sources
- GitHub Docs: Reuse workflows, fetched 19 October 2026
- GitHub Docs: Avoiding duplication, fetched 19 October 2026
Last reviewed: 19 October 2026.
