Design a CI/CD Pipeline for a Microservices Platform

Context

You are designing a CI/CD system for a containerized microservices platform deployed to cloud infrastructure (e.g., Kubernetes), with multiple teams contributing services in different languages. The goal is to ship changes safely and quickly while controlling cost and ensuring reliability and security.

Requirements

Describe a practical end-to-end design that covers:

1. Repository strategy
   • Monorepo vs. polyrepo trade-offs and tooling
2. Branching model
   • Trunk-based development vs. GitFlow; release/versioning
3. Build and isolation
   • Containerized builds, ephemeral runners, parallelization
4. Dependency caching
   • Language/package caching, Docker layer caching
5. Artifact storage
   • Images, packages, provenance/signing, retention
6. Testing strategy
   • Unit, integration, and end-to-end tests; test selection and flake management
7. Security scanning and supply chain
   • SAST/DAST, SCA, container scanning, SBOM, signing, policy
8. Secrets management
   • CI secrets, workload identity, runtime secrets
9. Environment promotion
   • Dev → staging → prod; approvals; GitOps vs. imperative
10. Progressive delivery
    • Canary and blue‑green deployments; automated analysis and rollback
11. Rollback strategy
    • App and database strategies; feature flags; version pinning
12. Observability
    • Logs, metrics, traces; SLOs; CI observability and DORA metrics
13. Runner scaling and cost controls
    • Autoscaling, spot/preemptible, caching, retention, concurrency controls

State any assumptions you make, call out risks/pitfalls, and explain key trade-offs.