Use this checklist before any change to production. Critical items must be confirmed before proceeding.
How to run it
Most items above carry a command. Run it and keep the
output — that is the difference between a checklist and a
declaration of intent. “Pre-checks completed” is an assertion;
systemctl list-units --state=failed returning 0 is
evidence, and it is evidence with a timestamp you can put in
the change record.
Three of the commands need values from your environment before they will run:
# Substitute your own values
CHANGE_REPO=/srv/git/infra
CHANGE_PLAN=changes/2026-08-11-postgres-minor.md
RUNBOOK_REPO=/srv/git/runbooks
CHANGE_PR=1421
BMC=node01-bmc.example.com
BMC_USER=changecontrol
PKG=postgresql-16The three that get skipped
Every item here exists because a change went wrong without it, but three are skipped far more often than the rest.
Drift. git -C /etc status --short returning nothing is
the check. A host with hand-edited config is not the host your
change was reviewed against, and your rollback restores the
committed state — silently discarding whatever an engineer
fixed by hand at 3am last quarter and never committed.
Somewhere to roll back to. “Rollback tested” is worth nothing if the previous package version has aged out of the repository, or the previous container image was pruned. Confirm the artefact still exists before you need it.
Out-of-band access, tested today. Any change that can
touch networking, sshd, the firewall or the kernel can
remove your own access to the host. The console you have not
used in a year is the one whose credentials expired. Confirm
it answers before the change, not after.
Sign-off
- Operator: _________________ Date: ___________
- Reviewer: ________________ Date: ___________