Software delivery
CI/CD and GitOps with change control
Every change goes through a pull request, tests, a signed artefact and GitOps to the environments.
Fictional scenario. An example situation that illustrates the approach. It is not a client project and describes no measured results.
Business problem
A fictional product team releases manually from a laptop. Changes are hard to trace and rollback is slow.
Assumptions
- Code is in Git.
- There is at least one test environment.
- Environments can be described declaratively.
Constraints
- No direct changes in production.
- Every change has an approval.
- Artefacts are immutable.
Reference architecture
Components by stage — an illustration, not a running system and not a certified design.
01Change
- Pull request
- Code review
02CI
- Tests
- Vulnerability scanning
- Signed image
03CD
- GitOps repository
- Promotion across environments
04Feedback
- Delivery metrics
- Automatic rollback on failure
The diagram as a list
| Stage | Components |
|---|---|
| Change | Pull request, Code review |
| CI | Tests, Vulnerability scanning, Signed image |
| CD | GitOps repository, Promotion across environments |
| Feedback | Delivery metrics, Automatic rollback on failure |
Interfaces
| From | To | Via |
|---|---|---|
| Git | CI | Webhook |
| CI | Registry | Publishing a signed image |
| GitOps | Environments | Pull model |
Data flow
- A pull request starts the tests.
- Review approves the change.
- The image is built once and signed.
- Promotion is a change in the GitOps repository.
- Delivery metrics are recorded.
Security boundaries
- Protected branches and mandatory review.
- Short-lived CI credentials (OIDC).
- Signature verification before deployment.
Where a person approves
- Review of every change.
- Promotion to production.
Delivery phases
01 · Assessment
Current process and metrics.
02 · CI
Tests and artefacts.
03 · GitOps
Environments as code.
04 · Improvement
Delivery metrics and automation.
Limitations
- It does not replace tests — it only runs them.
- Database schemas need their own strategy.
Trade-offs
- More checks — slower but safer.
- Pull model — more secure but harder to debug.
Related services
Related assessments
Integration patterns used
Workshops and assessments
Facing something similar?
We start with an assessment of where you are and propose a realistic first phase.