devops
5 minDevOps Foundations: Reproducible Builds and Artifact Promotion
Separate source, build inputs, artifacts, and deployment configuration so the release you test is the release you actually operate.
Search the library
18 matching resultsArticles and interview answers
devops
5 minDevOps Foundations: Safe Changes, Health Signals, and Rollback Boundaries
Design a release as a controlled change to code, configuration, and data, with explicit health checks and a recovery plan that matches what can actually be reversed.
Q&A
Q&AWhy can a binary rollback fail after a database migration?
Rollback restores code, not every side effect. Expand-and-contract changes preserve compatibility during overlap, and recovery assumptions must be exercised.
Read the concise answer
Rollback restores code, not every side effect. Expand-and-contract changes preserve compatibility during overlap, and recovery assumptions must be exercised.
devops
17 minRelease Safety Advanced: State, Schema Compatibility, and Artifact Trust
Connect immutable infrastructure, safe schema evolution, IaC lock recovery, artifact provenance, and CI isolation into one release discipline.
Q&A
Q&AWhat makes a CI OIDC trust policy meaningfully narrow?
It checks issuer, audience, repository and the intended protected job identity.
Read the concise answer
A valid signed token is not sufficient by itself. Match the intended claims, issue a narrowly scoped short-lived role, and prevent untrusted workflow code from running in that credentialed context.
Q&A
Q&AWhat identity should a delayed scheduled-job retry preserve?
Preserve the logical job and intended window, not the retry start time.
Read the concise answer
A logical run names the business partition; attempt IDs name executions of that run. Commit completion with the effect when they share storage, and handle remote effects with an explicit duplicate or reconciliation protocol.
Q&A
Q&AWhy promote the same immutable artifact rather than rebuild for production?
A rebuild is a new artifact, even at the same source commit. Promotion preserves the tested output while environment configuration remains deliberate and observable.
Read the concise answer
A rebuild is a new artifact, even at the same source commit. Promotion preserves the tested output while environment configuration remains deliberate and observable.
devops
8 minCI workload identity: replace copied cloud keys with scoped claims
Reason about OIDC trust, token audience, job identity, and short-lived cloud credentials.