Our deployment pipelines share a rule that looks old-fashioned next to modern continuous deployment: a machine may prepare a release, but only a person may make one. Staging is automatic, while going live is a button, pressed by a human, on purpose.
Automate the preparation, keep the decision
Everything reversible is automated without ceremony. Merges build themselves, tests run themselves, and the release candidate assembles itself on the production server, where it sits verified and ready. By the time a human enters the picture there is nothing left to do except the one thing automation should never do, which is decide that now is the moment this change meets the public.
That decision deserves a person for a plain reason. The pipeline knows the build passed its tests, but it cannot know that month-end starts tomorrow, that the client is mid-audit, or that a colleague is on leave and this is a bad week to need a rollback. Context of that kind lives in people’s heads rather than in the pipeline’s configuration.
Nothing irreversible without a gesture
The principle is broader than deployment: no irreversible action without a human gesture. Staging is reversible, so it runs automatically, while a release is a commitment, so it waits for a decision. The same line runs through how we handle data migrations, decommissioning, and anything else with a blast radius. Whenever the machine that did something cannot also undo it, a person owns the moment it happens.
None of this reflects distrust of automation. The automation does more here rather than less, carrying every step to the edge of the decision so that the decision itself is small, calm, and made with full information. The button is boring to press, and that is the point of the whole arrangement.
The cost, honestly
The price of the gesture is waiting: a finished release can sit for hours until its human arrives. We consider that a fair trade. The systems we run are the kind where a failed month-end is a board problem, and for infrastructure of that kind the value of shipping at two in the morning is low while the cost of an unowned incident is anything but. Speed belongs to the pipeline, and judgement belongs to the release.