Before deploymentci-cd-pre-deploy

Pre-Deployment Checklist

15 items ·10 critical ·5 warn ·0 info

How to use this checklist

This is the last gate before a deploy is allowed to start. It assumes the artifact, the pipeline, the runners, and the change itself have already passed their respective checklists; this one is the moment-of-truth check that nothing has changed since those were worked.

Treat any failed item as a stop-ship signal. The deploy can be re-attempted after the failure is fixed; it does not get a “we”ll fix it during deploy” waiver.

Sign-off

Every critical item must pass. A failing critical item blocks the deploy; it is not a note for later. Record the date, the reviewer, and the disposition of every item that did not pass.

Critical10 items

The artifact to be deployed is verified at deploy time: signature checked (cosign verify), SBOM scanned, provenance attestation validated against the expected repo, commit, and pipeline.

cosign verify --certificate-identity-regexp "https://github.com/&lt;org&gt;/&lt;repo&gt;" --certificate-oidc-issuer "https://token.actions.githubusercontent.com" ghcr.io/&lt;org&gt;/&lt;image&gt;@sha256:&lt;digest&gt;

The manifest, Helm values, or Kustomize overlay references the artifact by digest, not by tag. A deploy that resolves to a moving tag is rejected before it starts.
A change ticket exists, references the commit, the artifact digest, and the deploy pipeline run, and is in `approved` state in the change-management system. Deploying without an approved change is a hard error.
A human approver with production-deploy authority has approved the run. The approval is recorded against the pipeline run, not just stated in chat.
The target environment is healthy before the deploy begins: nodes Ready, no firing critical alerts, no concurrent deploys running against the same environment, and no pending restarts.
```
kubectl get nodes; kubectl get pods -A --field-selector=status.phase!=Running | head
```
GitOps environments are reviewed for active drift: `argocd app diff` / `flux diff` is empty (or only contains the intended change). Live drift is reconciled or escalated before the deploy, not after.
A concurrency lock is held for the environment being deployed (Terraform state lock, Kubernetes mutex, or platform environment lock). Two concurrent deploys to the same environment cannot both pass this gate.
Database migrations are forward-compatible with the previous application version, the migration has been rehearsed against a production-sized dataset, and the order of operations (migrate-then-deploy vs deploy-then-migrate) is recorded in the runbook.
A tested rollback command is at hand: `helm rollback`, `argocd app rollback`, `kubectl rollout undo`, a revert of the Terraform configuration to the known-good ref followed by a fresh reviewed `terraform plan`/`apply` against current state, or a database point-in-time-restore. The rollback has actually run before, not just been written down.
Configuration values that the deploy depends on (secrets, configmaps, environment variables) have been verified current: not stale from the last deploy, not expired, not referencing a previous environment.

Warning5 items

The deploy falls within an agreed change window for the target environment, and freeze periods (holidays, end-of-quarter, audit weeks) have been checked.
Feature flags referenced by the new artifact are reviewed: which are on, which are off, which the deploy is expected to flip, and what the rollback strategy is if a flag state needs to revert.
The dashboards, alerts, and log queries needed to validate the deploy are identified by URL. New alerts have been filed; suppressions have an expiry.
The on-call rotation knows about the deploy, the deploy window is reflected on the on-call calendar, and the change author is reachable for at least 30 minutes after the deploy starts.
Capacity headroom exists for the workload being deployed: the new replica count fits within the available resources, and there is a margin for the rollout (rolling update needs headroom).
```
kubectl describe node | awk '/Allocated resources:/,/Events:/' | head -30
```