Swimlane · 06 of 07 · Deploy and release

Deploy and release: different questions, different rigor

Deploy is optimised for speed and has no reviewers. Release is optimised for trust: the same artifact, independent required checks, a human, and a cluster that only ever changes by pulling a merged commit.

Deploy and release: different questions, different rigor Two swimlanes. Deploy, the fast inner loop: the deploy stage commits the lower environment file, ArgoCD on the dev cluster syncs it, and the app runs in dev as an Argo Rollout. Release, governed promotion: the release stage opens a pull request against the app's gitops repo carrying the digest that already passed, never rebuilt; real gates (SAST, image scan, provenance, SBOM, values) and clearly marked stub gates run as required checks; a human reviews under branch protection; after merge, the upper cluster's own ArgoCD is the only thing that changes it. DEPLOY · FAST INNER LOOPRELEASE · GOVERNED PROMOTIONdeploy stagelower environments onlyCommit env fileplatform/envs/dev.yamlArgoCD · devsyncs on commitRunning in devArgo Rollout · canaryrelease stageone PR per upper envPR to gitops-<app>same digest · not rebuiltReal gatessast · scan · provenance · sbomStub gatesitsm · qa · policy · promoteHuman reviewbranch protectionArgoCD · upperthe only writerMERGEDeploy asks whether a change works at all. Release asks whether it should run in front of customers.LEGENDPipeline stageThe changeCheck or systemStub, says soRequired checks

The same bytes

A release carries the exact image digest that passed test and deploy. Nothing is rebuilt for production, so what was tested is what ships.

Gates that say what they are

Five gates are real today (sast, image-scan, provenance, sbom, values). Four are stubs, and they are labelled as stubs everywhere they appear, because a gate that silently passes is worse than none.

Built

  • GitOps-only release (ADR-0004).
  • Provenance validates the attestation, plus the commit signature (ADR-0015).
  • Gates enforced as required checks by a GitHub ruleset.
Hangar · Glidepath