Two security skills that are part of the Continuous Integration aspect are application security and

penetration testing. Application security is the practice of protecting the software applications from

malicious attacks, unauthorized access, data breaches, and other threats. It involves applying

security principles and techniques throughout the software development lifecycle, such as secure

coding, code analysis, code review, security testing, and security monitoring. Application security

helps to ensure that the software meets the security requirements and standards, and that it does

not introduce any vulnerabilities or risks to the system or the users910

Penetration testing is the practice of simulating real-world attacks on the software applications to

identify and exploit any security weaknesses or flaws. It involves using various tools and methods to

probe, scan, attack, and bypass the security defenses of the software, such as firewalls, encryption,

authentication, and authorization. Penetration testing helps to evaluate the security posture and

resilience of the software, and to provide recommendations for improvement or

remediation. Penetration testing is usually performed by external or independent experts, who have

the permission and authorization to conduct the tests

The Release on Demand aspect enables the key business objective of delivering business value to

customers. Release on Demand is the process by which features deployed into production are

released incrementally or immediately to customers based on market demand. It is the final aspect

of the Continuous Delivery Pipeline (CDP) in SAFe DevOps, which enables the delivery of value to the

end user as fast as possible, based on market demand. The decision of what and when to release is a

critical economic driver that requires careful consideration of the customer needs, market rhythms,

and economic outcomes. Release on Demand is decoupled from the Continuous Deployment activity,

which automates the migration of new functionality from a staging environment to production,

where it is made available for release. Release on Demand involves four activities: release, stabilize

and operate, measure, and learn. These activities help to deliver the solution to end users, ensure

the solution is working well from a functional and nonfunctional perspective, quantify the value

delivered by the solution, and collect feedback and prepare for the next loop through the CDP3

Under the Respond activity in the context of DevOps, the practice of Rollback is often included.

Rollback is a key response mechanism used to quickly revert a system to a previous stable state in the

event of a failure or issue in the production environment. This practice is critical for maintaining

system stability and minimizing downtime.

In addition to Continuous Integration, two other aspects of the CDP are Continuous Deployment and

Continuous Exploration. Continuous Deployment automates the migration of new functionality from

a staging environment to production, where it is made available for release. Continuous Deployment

enables the ability to release value at any time, in a sustainable way. Continuous Exploration focuses

on creating alignment on what needs to be built, using design thinking and hypothesis-driven

development. Continuous Exploration enables the discovery of the most valuable solutions for the

customers and the enterprise

Gated commits are a key technical practice that enables trunk-based development. Gated commits

are a mechanism that ensures that only code that passes certain quality checks and tests can be

committed to the main trunk of the shared codebase. Gated commits prevent broken changes from

affecting other developers or the Continuous Delivery Pipeline. Gated commits typically involve the

following steps:

A developer writes code and runs local tests on their own machine or branch.

The developer pushes the code to a remote repository, where a pre-commit hook triggers a build and

test process on a separate server.

The build and test process verifies that the code meets the quality standards and does not introduce

any errors or conflicts with the existing code on the trunk.

If the build and test process succeeds, the code is automatically merged into the trunk and becomes

available for other developers and downstream activities.

If the build and test process fails, the code is rejected and the developer is notified of the issues that

need to be fixed before retrying the commit.

Gated commits support trunk-based development by ensuring that the trunk is always in a

releasable state, which means that at least once a day, developers must integrate their changes to

the trunk. This is accomplished through short-lived feature branches related to project tasks. Gated

commits reduce the complexity and conflicts of merging long-lived branches, improve the quality

and consistency of the code by enforcing frequent testing and validation, accelerate the delivery and

deployment of new functionality by minimizing the transaction cost and risk, and foster a culture of

collaboration and transparency among developers