> workflow / devops
DevOps
Automate build, deploy, and environment promotion with immutable artifacts, secrets hygiene, and safe progressive delivery defaults.
What should I do next?
Complete the steps and evidence below, clear the human gates, then continue to Monitoring.
When to use
- RC is functionally ready and needs promotion plumbing
- Environments, pipelines, or IaC are missing or manual
- You must enforce gates (tests, evals, security) in CI/CD
- Release pattern (canary/flag) must be wired before production
Step-by-step
- Define environment matrix (dev/stage/prod) and promotion rules.
- Build immutable artifacts; ban "ssh and edit prod".
- Wire CI gates: tests, evals, scanners, and hooks as blocking checks.
- Codify infra with reviewable IaC; validate in pipeline.
- Implement progressive delivery (canary, flags) per release-pattern.
- Write runbooks for deploy, rollback, and secret rotation.
- Run a dry-run deploy to stage; fix pipeline debt before prod go/no-go.
Decisions to make
- Blue/green vs canary vs flag-first for this RC
- Who can approve prod deploys (CAB vs on-call lead)
- Secret storage and rotation ownership
- Rollback trigger metrics and abort authority
Evidence to collect
- Pipeline config in git
- Environment matrix and promotion policy
- Successful stage deploy of the RC artifact
- Runbooks linked from the service README
Role-specific next actions
- PM: Align release window with customer commitments and change freezes.
- Architect: Approve infra changes that alter trust or data boundaries.
- Engineer: Keep app deployable; fix build/breakages immediately.
- DevOps: Own pipelines, IaC, and promotion safety.
Inputs
- Release candidate artifacts
- Infra definitions and secrets backend
- Release plan and SLO abort criteria
Outputs
- Pipeline and IaC configs
- Environment matrix
- Deploy/rollback runbooks
Required prompts
- Release
Structures release notes, gates, and rollback criteria.
Required skills
- DevOps
Primary delivery and platform skill.
Required MCP servers
- GitHub MCP
Pipeline and release PR operations.
- Docker MCP
Image/build introspection when containerized.
- Kubernetes MCP
Cluster inspection for k8s deployments.
Tooling & handbook
- Release pattern workflow
Progressive exposure with abort.
- deployment hook
Pre-deploy checks.
- post-deployment hook
Post-deploy verification.
- Release agent
Assists release checklists.
Recommended agents & patterns
- Release pattern
Primary pattern for this stage.
- DevOps agent
Assists pipeline/IaC changes under human ownership.
- Release agent
Release checklist co-pilot.
Human approval gates
- Production deploy approval per policy
- No manual prod mutation outside emergency hotfix path
Automation opportunities
- GitHub Actions / CI gates from test+security evidence
- IaC plan/apply with review
- Automated rollback triggers on canary abort metrics
Enterprise best practices
- Change windows and CAB where required
- Immutable artifacts with provenance
- Separate prod credentials from developer laptops
Common mistakes
- Manual prod edits
- Secrets in CI logs
- Pipelines that skip eval/security gates "temporarily"