Deploying depends on manual steps, or on one person being available
The goal is not more pipeline stages. It is that a release is the same event every time, that it can be undone, and that it does not need a particular person awake.
Usually raised by: Engineering director, delivery manager or platform lead.
What normally triggers it: A release that slipped because the person who runs them was away, a credential that has to be rotated, or an environment that behaved differently from the one it was tested in.
- GitHub Actions
- Azure DevOps
- GitLab
- AWS
You probably recognise some of these.
Not all of them, and not in this order. If three or four land, this is the page you want.
- Part of a release is a documented sequence somebody follows by hand.
- The CI system holds a long-lived cloud credential that nobody wants to rotate.
- Rolling back means working out what the previous state was.
- Releases cluster around whoever knows the procedure, and stop when they are on leave.
What is different afterwards.
One deployment path, exercised against the failure cases rather than only the happy one, with the credentials short-lived and the rollback written down and tried.
The work itself
- Take one deployment path and standardise it end to end, rather than improving several a little.
- Replace long-lived CI credentials with workload identity — OIDC federation where the platform supports it.
- Add the tests and checks that make a green pipeline mean something.
- Put an approval where a human decision genuinely belongs, and nowhere else.
- Define and exercise the rollback, including what happens to data.
Who does it: an InfraEdge engineer, who walks your team through what was found and answers your reviewer on each change.
One finding, end to end.
From the specimen assessment of a fictional company. Every real finding follows the same chain: evidence behind the claim, a change in your repository, and verification — not a slide recommending one.
Deployments authenticate as an IAM user whose static access key was created 431 days ago and never rotated. The attached policies amount to administrator access in practice.
iam.json · github.json — collected through a read-only role, each artefact hashed and timestamped
deploy.yml- aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }} - aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }} + permissions: + id-token: write + role-to-assume: arn:aws:iam::123456789012:role/ci-deploy + # OIDC: credentials issued per run; the trust policy pins the exact repository
The key is deleted, CI deploys through the short-lived role, and the change arrived as a pull request reviewed and merged by the customer — not a console edit.
One service, one deployment path, exercised
A single service you nominate, from commit to the environment you care most about.
Done when
The pipeline deploys that service without a manual step, authenticates without a stored long-lived key, and has been run against the agreed scenarios — a normal release, a failed check, and a rollback — with the results recorded.
What you receive
- Pipeline configuration in your repository
- Workload identity configuration and the trust policy behind it
- A rollback procedure that has actually been run, not only written
- An operations note: who owns this, what breaks, what to do about it
What we need from you
- Access to the repository and the CI system, and a named reviewer
- A non-production environment the rollback can be exercised against
- A decision on who approves a production release
What makes it larger or smaller for you.
The variables that drive the size, judged against your own estate.
Larger if
- Several services that each deploy a different way for historical reasons
- A CI platform with no workload-identity federation, so credentials need another answer
- A rollback that has to account for data, not only code
Smaller if
- One service, one target environment
- A CI system that already supports OIDC federation
- A non-production environment the failure cases can be exercised against
For a sense of elapsed time on work of this shape, the phased timeline on a comparable engagement is published with it. We do not quote a duration for your estate before seeing it, and the scope you receive after the call names the package rather than an hourly rate.
What this does not include.
Stated here rather than discovered later.
- We do not quote a release-frequency or lead-time improvement. We have not measured your current pipeline, and a number produced before that would be invented.
- Rewriting the application to be deployable is not included. Where the blocker is in the application rather than the platform, we will say so and scope it separately with you.
- Database schema migration strategy is its own discipline. We integrate with the approach you have; we do not design it as part of this.
We already have CI. Why would we pay someone to add more of it?
Mostly you would not. The work is usually subtraction: a manual step, a stored credential, a difference between two environments. If your pipeline already deploys without hands and your rollback has been exercised recently, you do not need this — and the triage call is the cheapest place to find out.
What we can point at.
Anonymised prior delivery, described by technical shape. No client names, no logos, and no figures we did not measure.
Problems that tend to arrive together.
Production was built in the console, and now it has to be defined as code
The estate works. That is exactly what makes this hard — an import that replaces a running resource is a worse day than the one you are trying to avoid.
The team knows what to do and cannot get to it
The objection to hiring help here is usually honest: managing a supplier can cost more time than doing the work. That is a scoping problem, and it is solvable.
Describe the project
Twenty minutes, no charge, with the engineer who would do the work. We work out whether this is the work you need and whether we are the right people — which is sometimes us and sometimes not. Nothing is priced on the call; if there is work worth doing, a written scope and a price reach you within 24 hours.