Activities - Design & Deploy CICD

#	Name	Abbrev.	Guidance	Actions
Elaboration 7
1	Review SAO & Define CICD Requirements	DCD-1	Review SAO & Define CICD Requirements Objective Read docs/architecture/SAO.md and DCI output. Define pipeline stages, …	Read the 'DCD-1 Review SAO & Define CICD Requirements' activity from playbook 'Junior Edda' (workflow 'Design & Deploy CICD'). Follow its guidance when assisting me. # Review SAO & Define CICD Requirements ## Objective Read `docs/architecture/SAO.md` and DCI output. Define pipeline stages, map to `make` targets, produce `CICD_REQUIREMENTS.md`. Pipeline shape depends on deployment style. --- ## Process ### 1. Read SAO.md Extract § Deployment Strategy, § Test Strategy, § CI/CD Pipeline. ### 2. Review DCI Output \| Style \| Confirm available \| \|-------\|-------------------\| \| EKS \| Cluster name, ECR URI, Route53 domain, `make traffic-switch` \| \| Elastic Beanstalk \| EB app/env names, ECR URI, `deploy-idle.sh`, `make swap`, S3 backup bucket \| ### 3. Choose Trigger Model \| Model \| When \| Trigger \| \|-------\|------\|---------\| \| Continuous \| Fast iteration, trunk-based \| Push to `main` → test + build \| \| Release-gated (Huginn) \| Production control, semver releases \| `gh release create vX.Y.Z` → test + build + deploy-idle \| Document choice in `CICD_REQUIREMENTS.md`. ### 4. Map Pipeline Stages → Make Targets #### EKS Path \| Stage \| Target \| Gate \| \|-------\|--------\|------\| \| Test \| `make test` \| All pass \| \| Build \| `make containers` \| ECR push \| \| Deploy idle \| `make deploy ENV=idle` \| Pods healthy \| \| Smoke \| `make smoke-test ENV=idle` \| Pass \| \| Switch \| `make switch` → infra `traffic-switch` \| Manual approval \| \| Verify prod \| `make smoke-test ENV=prod` \| Pass \| #### Elastic Beanstalk Path \| Stage \| Target \| Gate \| \|-------\|--------\|------\| \| Test \| `make test` \| All pass \| \| Build \| CI: ECR push (+ optional Docker Hub for client tools) \| Images pushed \| \| Backup \| `deploy-idle.sh` step 2 (SSM) \| S3 keys exist \| \| Deploy idle \| `deploy-idle.sh` \| EB Ready, Health ≠ Red \| \| Smoke \| `/health/` revision on idle CNAME \| Match `GIT_REVISION` \| \| Promote \| `make swap` or `promote.yml` \| Manual approval \| \| Verify prod \| `/health/` on HTTPS custom domain \| Revision match \| ### 5. Document CICD Requirements Create `docs/architecture/CICD_REQUIREMENTS.md` — see artifact template CICD Requirements (EB Reference). --- ## Deliverables - ✅ SAO.md reviewed - ✅ DCI output confirmed for chosen style - ✅ Trigger model documented (continuous vs release-gated) - ✅ Pipeline stages mapped to make targets - ✅ `CICD_REQUIREMENTS.md` created
2	Create Helm Chart & Values	DCD-2	Create Deployment Manifest Objective Create a versioned, per-environment deployment artifact that CI/CD uses to deploy …	Read the 'DCD-2 Create Helm Chart & Values' activity from playbook 'Junior Edda' (workflow 'Design & Deploy CICD'). Follow its guidance when assisting me. # Create Deployment Manifest ## Objective Create a versioned, per-environment deployment artifact that CI/CD uses to deploy the application. The artifact format depends on your deployment style (from Activity #74): Helm chart for Kubernetes/EKS, or Docker Compose template for Elastic Beanstalk. --- ## Process ### Path Selection Refer to `docs/architecture/INFRA_REQUIREMENTS.md` § Deployment Style. Follow the path for your chosen style. --- ## Kubernetes / EKS Path Skill: K8s in EKS Deployment Patterns (#23) ### 1. Create Helm Chart Structure ```bash mkdir -p deploy/helm/{project}/templates ``` ### 2. Create Chart.yaml ```yaml # deploy/helm/{project}/Chart.yaml apiVersion: v2 name: {project} description: Helm chart for {project} application type: application version: 0.1.0 appVersion: "0.1.0" ``` ### 3. Create Templates deployment.yaml: ```yaml apiVersion: apps/v1 kind: Deployment metadata: name: {{ .Release.Name }} namespace: {{ .Values.namespace \| default .Release.Namespace }} spec: replicas: {{ .Values.replicaCount }} selector: matchLabels: app: {{ .Release.Name }} template: metadata: labels: app: {{ .Release.Name }} spec: containers: - name: app image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}" imagePullPolicy: {{ .Values.image.pullPolicy }} ports: - containerPort: {{ .Values.service.targetPort }} envFrom: - configMapRef: name: {{ .Release.Name }}-config livenessProbe: httpGet: path: /health port: {{ .Values.service.targetPort }} initialDelaySeconds: 15 periodSeconds: 10 readinessProbe: httpGet: path: /health port: {{ .Values.service.targetPort }} initialDelaySeconds: 5 periodSeconds: 5 resources: {{- toYaml .Values.resources \| nindent 12 }} ``` service.yaml: ```yaml apiVersion: v1 kind: Service metadata: name: {{ .Release.Name }} namespace: {{ .Values.namespace \| default .Release.Namespace }} spec: type: {{ .Values.service.type }} selector: app: {{ .Release.Name }} ports: - port: {{ .Values.service.port }} targetPort: {{ .Values.service.targetPort }} ``` configmap.yaml: ```yaml apiVersion: v1 kind: ConfigMap metadata: name: {{ .Release.Name }}-config namespace: {{ .Values.namespace \| default .Release.Namespace }} data: {{- range $key, $value := .Values.config }} {{ $key }}: {{ $value \| quote }} {{- end }} ``` ### 4. Create Values Files values.yaml (defaults): ```yaml replicaCount: 2 image: repository: "{account}.dkr.ecr.{region}.amazonaws.com/{project}" tag: "latest" pullPolicy: IfNotPresent service: type: ClusterIP port: 80 targetPort: 8000 resources: requests: cpu: 250m memory: 256Mi limits: cpu: 500m memory: 512Mi config: LOG_LEVEL: "INFO" ENVIRONMENT: "production" ``` values-local.yaml, values-blue.yaml, values-green.yaml (per-environment overrides). ### 5. Verify Helm Template ```bash helm lint deploy/helm/{project} helm template {project} deploy/helm/{project} -f deploy/helm/{project}/values-local.yaml ``` --- ## Elastic Beanstalk Path Skill: AWS EB Blue/Green Deployment ### 1. Create Docker Compose Template EB uses a `docker-compose.yml` file to define the container. Create a template with environment variable substitution: ```yaml # deploy/docker-compose.tmpl.yml version: "3.8" services: web: image: ${IMAGE_WEB} ports: - "80:8000" environment: - MIMIR_ENV=production - DJANGO_SETTINGS_MODULE=mimir.settings restart: always ``` ### 2. Create Render Script CI/CD will substitute `IMAGE_WEB` at deploy time: ```bash # In .github/workflows/build-and-deploy.yml env: IMAGE_WEB: ${{ steps.ecr-login.outputs.registry }}/mimir:${{ steps.version.outputs.suffix }} run: \| envsubst '$IMAGE_WEB' < deploy/docker-compose.tmpl.yml > docker-compose.yml cat docker-compose.yml ``` ### 3. Create Deployment Bundle EB requires a `.zip` bundle containing `docker-compose.yml`: ```bash # In CI/CD zip -j deploy-bundle.zip docker-compose.yml ``` This bundle is uploaded to S3 and referenced when creating an EB application version. See AWS EB Blue/Green Deployment skill Pattern 1 for full `deploy-idle.sh` script. ### 4. Document Deployment Flow Add to `README.md` or `docs/deployment.md`: ```markdown ## EB Deployment Flow 1. CI builds Docker image, pushes to ECR 2. Render `docker-compose.yml` from template with `IMAGE_WEB={ecr-uri}:{tag}` 3. Zip `docker-compose.yml` → `deploy-bundle.zip` 4. Upload bundle to S3: `s3://{EB_BUCKET}/mimir/{VERSION_LABEL}/deploy-bundle.zip` 5. Create EB application version: `aws elasticbeanstalk create-application-version --version-label {VERSION_LABEL} --source-bundle S3Bucket={EB_BUCKET},S3Key=mimir/{VERSION_LABEL}/deploy-bundle.zip` 6. Deploy to idle: `aws elasticbeanstalk update-environment --environment-name {IDLE_ENV} --version-label {VERSION_LABEL}` 7. Smoke test idle, then swap: `aws elasticbeanstalk swap-environment-cnames --source-environment-name {IDLE_ENV} --destination-environment-name {LIVE_ENV}` ``` --- ## Commit (Both Paths) ```bash git add deploy/ git commit -m "feat(deploy): add deployment manifest ({Helm chart\|EB docker-compose template})" ``` --- ## Deliverables (Style-Agnostic) - ✅ Deployment manifest created (Helm chart OR docker-compose template) - ✅ Per-environment values/overrides defined - ✅ Rendering verified (`helm template` OR `envsubst` test) - ✅ `make deploy ENV=<env>` works locally (after Activity #83) ## Inputs Read these before starting this activity. They are produced earlier in the playbook and are authoritative — raise a drift event instead of deviating. - SAO.md (Document, Required) — produced by Write SAO.md (#59). - INFRA_REQUIREMENTS.md (Document, Required) — produced by Review SAO & Define Infra Requirements (#74).
3	Add Container & Deploy Make Targets	DCD-3	Add Container & Deploy Make Targets Objective Extend the application Makefile (from BSP-06) with container, …	Read the 'DCD-3 Add Container & Deploy Make Targets' activity from playbook 'Junior Edda' (workflow 'Design & Deploy CICD'). Follow its guidance when assisting me. # Add Container & Deploy Make Targets ## Objective Extend the application Makefile (from BSP-06) with container, deployment, and operations targets. Uncomment and configure the `##@ Deployment` section in the Makefile template. After this activity, every deployment operation is a single `make` command. --- ## Process ### 1. Add Dockerfile Create a multi-stage Dockerfile in the app monorepo: ```dockerfile # Dockerfile # Stage 1: Build FROM python:3.12-slim AS builder WORKDIR /app COPY requirements.txt . RUN pip install --no-cache-dir -r requirements.txt COPY . . # Stage 2: Runtime FROM python:3.12-slim WORKDIR /app COPY --from=builder /usr/local/lib/python3.12/site-packages /usr/local/lib/python3.12/site-packages COPY --from=builder /app . EXPOSE 8000 CMD ["gunicorn", "--bind", "0.0.0.0:8000", "{project}.wsgi:application"] ``` ### 2. Uncomment & Configure Makefile Deployment Section In the Makefile (from `BSP/artifacts/makefile_template.mk`), uncomment and configure the `##@ Deployment` section: ```makefile # Add/update these variables at the top PROJECT := {project} AWS_REGION := {region} AWS_ACCOUNT := {account-id} ECR_REPO := $(AWS_ACCOUNT).dkr.ecr.$(AWS_REGION).amazonaws.com/$(PROJECT) HELM_CHART := deploy/helm/$(PROJECT) ENV ?= local NAMESPACE ?= $(ENV) DOMAIN := {domain} IMAGE_TAG := $(shell git rev-parse --short HEAD) ##@ Containers containers: ## Build and push Docker image to ECR @echo "Building container $(ECR_REPO):$(IMAGE_TAG)..." docker build -t $(ECR_REPO):$(IMAGE_TAG) -t $(ECR_REPO):latest . @echo "Pushing to ECR..." aws ecr get-login-password --region $(AWS_REGION) \| docker login --username AWS --password-stdin $(AWS_ACCOUNT).dkr.ecr.$(AWS_REGION).amazonaws.com docker push $(ECR_REPO):$(IMAGE_TAG) docker push $(ECR_REPO):latest @echo "✅ Pushed $(ECR_REPO):$(IMAGE_TAG)" containers-local: ## Build Docker image for local K8s (no push) docker build -t $(PROJECT):local . @echo "✅ Built $(PROJECT):local" ##@ Deployment deploy: ## Deploy to environment (ENV=local\|blue\|green) @echo "Deploying to $(ENV) (namespace: $(NAMESPACE))..." helm upgrade --install $(PROJECT) $(HELM_CHART) \ -f $(HELM_CHART)/values.yaml \ -f $(HELM_CHART)/values-$(ENV).yaml \ --set image.tag=$(IMAGE_TAG) \ --namespace $(NAMESPACE) \ --create-namespace \ --wait --timeout 300s @echo "✅ Deployed to $(ENV)" deploy-local: ## Deploy to local K8s $(MAKE) containers-local $(MAKE) deploy ENV=local deploy-blue: ## Deploy to blue namespace $(MAKE) deploy ENV=blue deploy-green: ## Deploy to green namespace $(MAKE) deploy ENV=green ##@ Traffic & Operations smoke-test: ## Run smoke tests (ENV=blue\|green\|prod) @echo "Running smoke tests on $(ENV)..." $(PYTEST) tests/smoke/ -v --base-url=https://$(ENV).$(DOMAIN) 2>&1 \| tee smoke-tests.log @echo "✅ Smoke tests passed on $(ENV)" switch: ## Switch prod ↔ idle DNS traffic @echo "Switching traffic: prod ↔ idle..." cd ../$(PROJECT)-infra && $(MAKE) traffic-switch @echo "✅ Traffic switched. Verify at https://prod.$(DOMAIN)" rollback: ## Rollback to previous deployment @echo "Rolling back traffic..." cd ../$(PROJECT)-infra && $(MAKE) traffic-rollback @echo "✅ Rolled back" verify: ## Full verification: test + integration + smoke $(MAKE) test $(MAKE) test-integration $(MAKE) smoke-test ENV=$(ENV) @echo "✅ Full verification passed for $(ENV)" pipeline-status: ## Show current deployment status @echo "=== Blue Namespace ===" kubectl get pods -n blue 2>/dev/null \|\| echo " (not deployed)" @echo "=== Green Namespace ===" kubectl get pods -n green 2>/dev/null \|\| echo " (not deployed)" @echo "=== DNS ===" dig +short prod.$(DOMAIN) 2>/dev/null \|\| echo " (not configured)" dig +short idle.$(DOMAIN) 2>/dev/null \|\| echo " (not configured)" ``` ### 3. Verify All New Targets ```bash make help # Should show new sections: Containers, Deployment, Traffic make containers-local # Should build Docker image make deploy-local # Should deploy to local K8s make pipeline-status # Should show pod status ``` ### 4. Test Local End-to-End ```bash # Build and deploy locally make deploy-local # Verify pods running kubectl get pods -n local # Port forward and test kubectl port-forward -n local svc/{project} 8080:80 curl http://localhost:8080/health ``` ### 5. Commit ```bash git add Makefile Dockerfile git commit -m "feat(deploy): add container and deployment make targets" ``` --- ## Deliverables - ✅ Dockerfile created (multi-stage) - ✅ Makefile extended with `containers`, `deploy`, `switch`, `rollback`, `verify`, `pipeline-status` - ✅ `make help` shows new sections - ✅ Local deploy verified (`make deploy-local`) - ✅ All new `make` targets functional ## Inputs Read these before starting this activity. They are produced earlier in the playbook and are authoritative — raise a drift event instead of deviating. - Helm Chart Template (Template, Required) — produced by Create Helm Chart & Values (#82). - Makefile Template (Code, Required) — produced by Create Makefile (#93).
4	Build CI Pipeline	DCD-4	APPEND TO GUIDANCE: Release-Gated CI (Huginn Model) For EB / release-gated projects, CI runs on …	Read the 'DCD-4 Build CI Pipeline' activity from playbook 'Junior Edda' (workflow 'Design & Deploy CICD'). Follow its guidance when assisting me. APPEND TO GUIDANCE: --- ## Release-Gated CI (Huginn Model) For EB / release-gated projects, CI runs on published GitHub Releases (and `workflow_dispatch`), not every push: ```yaml on: release: types: [published] workflow_dispatch: # Push to main → no CI run (intentional — human controls ship via gh release create) ``` Why: Prevents concurrent deploy races (`UpdateEnvironment: Must be Ready`) and gives explicit semver control. ### Dual Registry Build \| Image \| Registry \| Deployed to EB? \| \|-------\|----------\|-----------------\| \| Web app \| ECR (private) \| Yes \| \| MCP facade / CLI tool \| Docker Hub (public) \| No — client-side only \| ### Auth Options \| Method \| When \| \|--------\|------\| \| OIDC `role-to-assume` \| Preferred for org repos \| \| IAM access keys in secrets \| Acceptable for single-team projects \| Do not treat access keys as always wrong — document trade-off in `CICD_REQUIREMENTS.md`.
5	Build CD Pipeline	DCD-5	APPEND TO GUIDANCE: TAF Integration: E2E Staging Gate in CD Add an E2E test stage …	Read the 'DCD-5 Build CD Pipeline' activity from playbook 'Junior Edda' (workflow 'Design & Deploy CICD'). Follow its guidance when assisting me. APPEND TO GUIDANCE: --- ## TAF Integration: E2E Staging Gate in CD Add an E2E test stage in the CD pipeline that runs after deploying to the idle/staging environment and before the release/swap: ```yaml e2e-staging: needs: smoke-test runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Setup Python uses: actions/setup-python@v5 - name: Install dependencies run: make provision - name: Install Playwright run: playwright install chromium - name: Run E2E against staging run: make test-e2e BASE_URL=${{ vars.STAGING_URL }} DB_URI=${{ vars.STAGING_DB_URI }} - name: Upload E2E screenshots if: always() uses: actions/upload-artifact@v4 with: name: e2e-screenshots-${{ github.sha }} path: tests/e2e/screenshots/ retention-days: 14 release: needs: e2e-staging ``` ### Pipeline Flow (updated) ``` CI: lint → test-unit → test-integration → test-at → build container → push to ECR CD: deploy-idle → smoke → E2E on staging (screenshots) → release → approve → switch → verify-prod ``` E2E fail → pipeline stops → no release → no swap. Screenshots are always archived for debugging.
6	Implement Switch & Rollback	DCD-6	Implement Switch & Rollback Objective Ensure traffic switch and rollback work reliably end-to-end. Mechanism depends …	Read the 'DCD-6 Implement Switch & Rollback' activity from playbook 'Junior Edda' (workflow 'Design & Deploy CICD'). Follow its guidance when assisting me. # Implement Switch & Rollback ## Objective Ensure traffic switch and rollback work reliably end-to-end. Mechanism depends on deployment style. --- ## Path Selection \| Style \| Switch \| Rollback \| \|-------\|--------\|----------\| \| EKS \| `make switch` → infra `traffic-switch` (Route53 weights) \| `make rollback` → infra `traffic-rollback` \| \| Elastic Beanstalk \| `make swap` → `promote-prod.sh` (CNAME swap) \| Another CNAME swap — previous version still running on other env \| --- ## EKS Path Verify `make switch` and `make rollback` delegate to infra repo. Create `.github/workflows/rollback.yml` with confirmation gate calling `make rollback`. --- ## Elastic Beanstalk Path Skill: AWS EB Blue/Green Deployment ### 1. Verify `make swap` ```makefile swap: ## Promote idle → prod bash scripts/promote-prod.sh ``` Test: deploy to idle → `make swap` → prod `/health/` revision matches. ### 2. EB Rollback = Second Swap No Helm rollback or Route53 weight change. The previously-live env still runs the old image: ```bash # If prod is bad after swap: make swap # swaps back — old env becomes prod again ``` Document: rollback time ≈ CNAME swap + 90s DNS + smoke poll (~3 min max). ### 3. Create `promote.yml` (GitHub) ```yaml name: Promote to Production on: workflow_dispatch: inputs: expected_revision: description: 'Release tag or EB VersionLabel (optional)' required: false jobs: promote: environment: production # approval gate steps: - run: bash scripts/promote-prod.sh env: EB_APP: {project} EB_ENV_A: {project}-prod EB_ENV_B: {project}-idle EXPECTED_REVISION: ${{ inputs.expected_revision }} MIMIR_PROD_URL: https://app.example.com ``` ### 4. Optional Emergency Rollback Workflow `.github/workflows/rollback.yml` — same as promote (another swap), with confirmation input `type "rollback"`. ### 5. Runbook Document in README: - Promote: review idle URL → `gh workflow run promote.yml` or `make swap` - Rollback: `make swap` again (no redeploy needed) - When: smoke fails after promote, user reports, monitoring alerts --- ## Deliverables - ✅ Switch verified for chosen style - ✅ EB: rollback documented as second CNAME swap - ✅ `promote.yml` with production approval gate - ✅ Optional `rollback.yml` with confirmation - ✅ Runbook documented - ✅ Rollback time measured (< 3 min for EB)
7	End-to-End Pipeline Verification	DCD-7	End-to-End Pipeline Verification Objective Ship a test feature through the entire pipeline: code change → …	Read the 'DCD-7 End-to-End Pipeline Verification' activity from playbook 'Junior Edda' (workflow 'Design & Deploy CICD'). Follow its guidance when assisting me. # End-to-End Pipeline Verification ## Objective Ship a test feature through the entire pipeline: code change → CI (test, build) → CD (deploy idle, smoke, approve, switch) → verify production. This is the acceptance gate for the DCD workflow. --- ## Process ### 1. Prepare a Test Feature Make a visible change to verify the full pipeline: ```bash # Add a version endpoint # e.g., GET /version returns {"version": "0.1.0", "commit": "{sha}"} ``` Write tests for it: ```bash # Add test git add . git commit -m "feat: add /version endpoint for pipeline verification" ``` ### 2. Push and Watch CI ```bash git push origin main ``` Monitor GitHub Actions → CI workflow: - ✅ `make provision` — dependencies installed - ✅ `make lint` — no warnings - ✅ `make test` — all tests pass - ✅ `make test-integration` — all pass - ✅ `make containers` — image pushed to ECR Verify image in ECR: ```bash aws ecr describe-images --repository-name {project} \ --query 'imageDetails \| sort_by(@, &imagePushedAt) \| [-1].imageTags' --output text ``` ### 3. Watch CD Pipeline CD triggers automatically after CI succeeds: - ✅ deploy-idle — `make deploy ENV=idle` → pods running in idle namespace - ✅ smoke-test — `make smoke-test ENV=idle` → smoke tests pass Verify idle deployment: ```bash kubectl get pods -n {idle-namespace} curl https://idle.{domain}/version # Should show new version ``` ### 4. Approve Switch In GitHub Actions → CD workflow: - The `switch` job is waiting for approval - Review the smoke test results - Approve in the production environment ### 5. Verify Production After approval: - ✅ `make switch` — DNS weights swapped - ✅ `make smoke-test ENV=prod` — production smoke tests pass ```bash curl https://prod.{domain}/version # Should show new version with current commit SHA ``` ### 6. Test Rollback ```bash # Trigger rollback via GH Actions or CLI make rollback # Verify prod reverted curl https://prod.{domain}/version # Should show previous version # Switch back (re-apply the new version) make switch curl https://prod.{domain}/version # Should show new version again ``` ### 7. Create Verification Checklist Document in `docs/architecture/CICD_VERIFICATION.md`: ```markdown # CI/CD Verification ## Pipeline Summary \| Step \| Status \| Duration \| Notes \| \|------\|--------\|----------\|-------\| \| CI: provision \| ✅ \| ~2 min \| Dependencies cached \| \| CI: lint \| ✅ \| ~30 sec \| Zero warnings \| \| CI: test \| ✅ \| ~1 min \| All pass \| \| CI: test-integration \| ✅ \| ~2 min \| All pass \| \| CI: containers \| ✅ \| ~3 min \| Image: {sha} \| \| CD: deploy-idle \| ✅ \| ~2 min \| Pods healthy \| \| CD: smoke-test \| ✅ \| ~1 min \| All pass \| \| CD: approval \| ✅ \| Manual \| Approved by {user} \| \| CD: switch \| ✅ \| ~60 sec \| DNS propagated \| \| CD: verify-prod \| ✅ \| ~1 min \| All pass \| \| Rollback \| ✅ \| ~60 sec \| DNS reverted \| ## Total Pipeline Time - CI: ~8 min - CD (auto): ~5 min - CD (manual): depends on reviewer - Rollback: ~60 sec ## Make Targets Verified \| Target \| Works Locally \| Works in CI/CD \| \|--------\|--------------\|----------------\| \| make provision \| ✅ \| ✅ \| \| make lint \| ✅ \| ✅ \| \| make test \| ✅ \| ✅ \| \| make containers \| ✅ \| ✅ \| \| make deploy ENV=... \| ✅ \| ✅ \| \| make smoke-test ENV=... \| ✅ \| ✅ \| \| make switch \| ✅ \| ✅ \| \| make rollback \| ✅ \| ✅ \| \| make pipeline-status \| ✅ \| ✅ \| ``` ### 8. Commit ```bash git add docs/architecture/CICD_VERIFICATION.md git commit -m "docs: add CI/CD verification checklist — pipeline fully operational" ``` --- ## Deliverables - ✅ Test feature shipped through full pipeline - ✅ CI pipeline — test → build → push verified - ✅ CD pipeline — deploy idle → smoke → approve → switch verified - ✅ Rollback tested and verified - ✅ `docs/architecture/CICD_VERIFICATION.md` — checklist documented - ✅ Local and CI/CD parity — all `make` targets work identically in both ## Inputs Read these before starting this activity. They are produced earlier in the playbook and are authoritative — raise a drift event instead of deviating. - Helm Chart Template (Template, Optional) — produced by Create Helm Chart & Values (#82). - CI Pipeline (GitHub Actions) (Code, Required) — produced by Build CI Pipeline (#84). - CD Pipeline (GitHub Actions) (Code, Required) — produced by Build CD Pipeline (#85).

Activities in Design & Deploy CICD