02 · CI/CD details
Document version v2026100501 · How a delivery becomes a deployment, and one way to build the pipeline that produces it. · interactive original ↗
From delivery to deploy (SRE side — contract)
- D-1: the Release Manager opens one deployment request per repo — tag, full commit hash, release plan, revert method.
- Check: the tag must resolve to the delivered hash; a mismatch is not deployed.
- Gray: release day 11:00–14:00, the whole set, any number of rounds; a problem in any repo withdraws the whole set for re-delivery. Gray ends at 14:00; not passed → next release day.
- Production: each repo in release-plan order, same artifact digest as gray.
- Rollback: previous versions in reverse release-plan order, or a config-only toggle change.
| Environment repo path | Approved by | After approval |
|---|---|---|
workloads/<svc>/<self-verification env>/ | Auto-merged | GitOps sync |
workloads/<svc>/gray/ | SRE (CODEOWNERS) | GitOps sync |
workloads/<svc>/production-<cluster>/ | SRE (CODEOWNERS) | GitOps sync |
workloads/<svc>/production-vm/ | SRE | Deployment job checks out the tag on the VM and restarts |
| Rollback | SRE | Each repo back to its previous version, in reverse release-plan order |
App-repo pipeline (template)
- MR / push:
test; manualdeploy-dev;check-mergeon MRs intomaster. - rc tag:
tag-verify→build(the only build for gray / production) →request-deploy(opens the deployment request with tag, hash and digest). - Release tag:
tag-verify→retag→release-notes→cleanup. The release tag neither builds nor deploys.
| Guard | Conditions |
|---|---|
check-merge (MR → master) | Source is release/* or hotfix/*; its latest commit is exactly the rc in production; master is an ancestor of that commit. |
tag-verify (tag pipeline) | rc tag: commit is on release/* or hotfix/*. Release tag: commit is the tip of master, its file tree equals an rc, and that rc is its ancestor. |
Three stacks (template)
| Next.js | Java Spring Boot | Laravel | |
|---|---|---|---|
| Build | multi-stage, output: 'standalone' | multi-stage jar → JRE image | multi-stage, composer install --no-dev |
| Settings | Runtime env on the server; no environment values in NEXT_PUBLIC_* | Runtime env / mounted application-prod.yaml | Runtime env → config/*.php |
| Restart on setting change | Env: yes; mounted file: no | Yes (default) | Yes (config:cache) |
| Health | /api/health | /actuator/health/readiness | /up |