Gates, not stages. Each step on this page can fail the pipeline: coverage, integration, contract, security scan, Terraform policy, and a human change approval before production.
Contract tests on task and workflow events are non-negotiable, because handlers are deployed independently of the orchestrator. A message schema change that passes unit tests and breaks a worker is the failure mode this exists to prevent.
GitHub Actions authenticates to Azure with OIDC federation. No service principal secret exists in the CI system, which removes the most commonly leaked credential in an enterprise estate.
Zero-downtime mechanics
Control plane rolls with a PodDisruptionBudget and maxUnavailable of 1. In-flight HTTP requests drain; nothing else is in flight because the control plane holds no long operations.
Workers drain rather than roll: on SIGTERM a pod stops receiving, finishes or abandons its lease, then exits. A task interrupted mid-flight is redelivered, which is safe precisely because of view 17.
Automatic rollback triggers on SLO burn above 2% in 15 minutes, redeploying the previous image digest. Rollback is to a digest, never a tag, because tags move.
Assumptions
Staging carries a load and chaos suite that reproduces every failure mode in view 31. A release that has not run it is not a release candidate.
Infrastructure is Terraform with policy-as-code; Helm charts are versioned with the image they deploy so a rollback moves both together.
Database schema changes are additive and forward-compatible for one release, so a rollback never requires a data migration.
