Release Engineering
Turn a release into a sequence of evidence-backed decisions rather than one
irreversible event.
Build the release contract
Record the artifact/version, environments, owner, change scope, affected users,
data or contract changes, dependencies, risk class, maintenance window, and
success metrics. Use release-record.md for the
go/no-go and rollout record.
Establish gates
Require checks proportional to risk: build and tests, contract and migration
proof, security findings, performance budgets, smoke paths, accessibility or
visual checks, artifact signing/provenance, monitoring, and a tested recovery
path. A green generic pipeline is not proof of the release's critical behavior.
Roll out safely
- Separate deployment from exposure with a flag or routing control when
practical.
- Start with internal, shadow, canary, or low-percentage traffic.
- Compare errors, latency, saturation, business outcomes, and support signals
against a pre-release baseline.
- Promote only after the observation window and all gates pass.
- Roll back or disable immediately when a predefined threshold is crossed.
- Verify recovery, communicate status, and preserve the timeline.
For canaries and production observation windows, use
post-deploy-verification.md. Confirm
the deployed build marker, run critical browser journeys through
browser-testing, and record each promote, hold, or rollback decision against
fresh baseline evidence.
Use immutable artifacts across environments. Keep release credentials out of
logs and command lines. Require explicit authority for production mutation.
Close the release
Verify critical paths after deployment, monitor delayed jobs and regional
effects, remove stale flags and compatibility paths on schedule, update release
notes, and create owned follow-ups for non-blocking debt. Never substitute a
successful deployment command for an observation window. Use
incident-response if live impact begins and safe-migrations for stateful
cutovers.
Completion condition
The intended artifact reached the intended audience, promotion evidence and
remaining limits are recorded, rollback readiness was real, and temporary
release controls have owners and expiry dates.