Devops

DevOps

When to Use

• Build, fix, or optimize CI/CD pipelines and release automation
• Implement GitOps, artifact promotion, container delivery, or environment automation
• Set up service observability, SLOs, alerting, and runbooks for delivery infrastructure
• Operate on-call workflows for build, deploy, and runtime reliability issues
• Standardize deployment mechanics for application teams

When NOT to Use

• Design rollout strategy, cutover, rollback triggers, or release risk tiers → deployment-strategist
• Build internal developer portals, golden paths, or platform-as-product roadmaps → platform-engineer
• Provision core cloud networks, IAM, or Terraform modules as the main task → infrastructure-engineer
• Add security gates, SBOMs, artifact signing, or CI threat modeling → devsecops
• Design SEV programs, paging policy, or postmortem process → incident-management-engineer
• Deep SLO/error-budget program, PRR, reliability engineering per service → site-reliability-engineer

Related skills

Core Workflows

1. CI/CD pipeline design

Standard stage order:

checkout → lint/test → build → publish artifact → deploy non-prod → integration/e2e → promote prod

Checklist:

• [ ] Pipeline as code in repo; versioned with application
• [ ] Reproducible builds (locked deps, pinned base images)
• [ ] Parallelize independent jobs; cache dependencies
• [ ] Artifact immutability (digest, not floating tag)
• [ ] Manual or policy gate before production
• [ ] Rollback path documented and tested quarterly

See `references/cicd_releases.md` for GitHub Actions, GitLab CI, and deployment patterns.

2. GitOps and environments

1. Declare desired state in git (Helm, Kustomize, Terraform for apps) 2. Sync via Argo CD or Flux; drift detection enabled 3. One branch or path per environment; promotion via PR 4. Secrets never in git—use External Secrets / sealed secrets 5. Audit sync events and failed reconciliations

See `references/gitops_environments.md` for promotion flows and config layering.

3. Observability and SRE

Minimum observability per service:

SLO workflow: pick SLI → set target and error budget → alert on burn rate → review in weekly ops.

See `references/observability_sre.md` for SLI examples, alert hygiene, and runbook links.

4. Incident and on-call

1. Triage severity (customer impact, data risk) 2. Mitigate (rollback, scale, feature flag) 3. Communicate status on cadence 4. Post-incident review within 48h for SEV1–2 5. Track action items to closure

See `references/incident_oncall.md` for severity matrix and handoff template.

5. Developer platform (optional)

• Golden paths: template repos, standard pipelines, local dev parity
• Self-service environments with guardrails
• Cost and quota visibility per team

See `references/platform_engineering.md` for IDP scope and build-vs-buy.

When to load references

• Pipelines and releases → references/cicd_releases.md
• GitOps and env promotion → references/gitops_environments.md
• Metrics, SLOs, alerts → references/observability_sre.md
• Incidents and on-call → references/incident_oncall.md
• Internal developer platform → references/platform_engineering.md

CI/CD and releases

Table of contents

1. Branching 2. Deployment strategies 3. GitHub Actions patterns 4. Rollback

Branching

Deployment strategies

GitHub Actions patterns

• Use environments with required reviewers for production
• Reuse workflows (workflow_call) for standard build
• Cache node_modules / pip with lockfile hash key
• Upload artifacts between jobs; deploy job downloads digest-pinned image

Rollback

1. Identify last known good artifact digest 2. Redeploy without rebuilding when possible 3. Run smoke tests 4. Post-incident: fix forward plan and pipeline guard

GitOps and environments

Table of contents

1. Repository layout 2. Promotion flow 3. Drift and secrets

Repository layout

apps/
  my-service/
    overlays/
      dev/
      staging/
      prod/

Or mono-repo environments/prod/ with Kustomize bases.

Promotion flow

1. PR changes staging overlay → auto-sync 2. Soak period + automated tests 3. PR promotes same image tag/digest to prod 4. Argo CD sync with manual sync option for prod

Drift and secrets

• Enable auto-sync for dev only; prod may require manual sync
• Never commit plaintext secrets; use External Secrets Operator
• Alert on OutOfSync > N minutes for production apps

Incident and on-call

Table of contents

1. Severity matrix 2. Handoff template 3. Post-incident review

Severity matrix

Handoff template

## Handoff — [date]
### Open incidents
### Deploys last 24h
### Alerts flapping
### Planned work

Post-incident review

Blameless: timeline, root cause, contributing factors, action items with owners and dates.

Observability and SRE

Table of contents

1. SLI examples 2. Alerting rules 3. Dashboards

SLI examples

Alerting rules

• Page on user-visible SLO burn (multi-window)
• Ticket on non-urgent threshold breaches
• Suppress alerts during planned maintenance

Dashboards

• Golden signals per service
• Deploy annotations correlated with error rate
• Cost dashboard for top spenders (optional)

Platform engineering

Table of contents

1. IDP scope 2. Golden paths 3. Metrics

IDP scope

Typical internal developer platform includes:

• Template repositories and scaffolding CLI
• Standard CI/CD workflows
• Environment provisioning APIs
• Service catalog and ownership metadata

Golden paths

Document the blessed way to:

• Create a service
• Add observability
• Ship to production

Discourage snowflake pipelines unless exception approved.

Metrics