Deployment Procedure

Policy

Deployments use build-once, deploy-many. Production receives an already-built artifact identified by a SemVer tag and pinned digest. Rebuilding from source during promotion is not allowed because it weakens traceability and makes rollback evidence ambiguous.

Preview before mutation

Infrastructure and platform deployments must produce a reviewable plan, diff, dry-run or rendered manifest before any production-impacting command is executed.

Flow

flowchart LR
  mr[Merge request] --> checks[Lint, tests, SAST, SCA, IaC]
  checks --> image[Build image once]
  image --> evidence[SBOM, PBOM, provenance, signature]
  evidence --> staging[Deploy staging]
  staging --> approval[Manual production approval]
  approval --> production[Promote digest to production]

Execution Modes

Application

1. Validate the merge request pipeline and review security findings.

2. Build the image once and publish SBOM, provenance and signature artifacts.

3. Deploy the same digest to staging.
4. Run health, integration and DAST checks against staging.

5. Promote the approved digest to production with a recorded deployment event.

Kubernetes

1. Render Helm manifests or Argo CD applications from the exact Git revision.

2. Run schema, policy and security validation before sync.
3. Review Argo CD diff and Kyverno policy impact.
4. Sync in the expected wave order.

5. Confirm rollout status, alerts and post-deployment health checks.

Ansible

1. Run ansible-playbook --check --diff with the intended inventory.

2. Document tasks that cannot predict changes in check mode.
3. Execute the playbook only after the diff is reviewed.
4. Re-run in check mode to validate idempotence.
5. Record service health and rollback instructions.

Required Checks

• Unit tests and integration tests pass.
• Secret scanning passes or has a documented exception.
• Image scan is reviewed.
• Deployment diff is reviewed.
• Rollback target is known.

Rollback

Rollback uses the previous known-good digest, not a rebuild from source.