URL Shortener & Link Management Service  ·  View 19 of 23  ·  Operations

Release Pipeline

Shipping to a path that cannot stop, with the three gates that test the promises rather than the code.

Editable source SVG draw.io All views
Source Mono-repo services + Bicep Pull request 2 reviewers Build GitHub Actions OIDC to Azure Signed image ACR + attestation Gates Redirect contract test status codes frozen Uniqueness race test concurrent claims Resolver latency gate p99 ≤ 40 ms Staging Staging region shadow traffic replay Canary One read region 5% of PoP origins SLO watchdog auto rollback Fleet 12 read regions one at a time Management plane deployed last Schema and data Additive-only migrations no destructive step Projection rebuild drill monthly, timed required check rollback readers first Release Pipeline — Shipping to a Path That Cannot Stop Application we own Security / platform Data store synchronous failure / alternate batch Read regions ship before the management plane, because a resolver that cannot read a new field is a worse failure than a management plane that cannot yet write one. v 1.0 · owner Platform Architecture · date 2026-09

The gates that matter

  • Redirect contract test: the status codes, cache headers and parameter merge order are frozen and diffed on every pull request.
  • Uniqueness race test: concurrent claims for the same alias, asserting exactly one winner. This is the test that protects the platform's only zero-tolerance guarantee.
  • Resolver latency gate: p99 ≤ 40 ms against a representative hot/cold mix, failing the build rather than the region.

Order of rollout

  • Read regions ship before the management plane: a resolver that cannot read a new field is worse than a management plane that cannot yet write one.
  • Canary is one read region at 5% of PoP origin weight, with automatic rollback on SLO breach.
  • Migrations are additive-only; no destructive step is permitted in a release that touches the link table.

Drills

  • The projection rebuild is exercised monthly and timed against the 30-minute objective. An untested rebuild is an assumption, not a recovery plan.
◀  Deployment Architecture All views Observability  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-09 · 23 views · 16 architecture decision records19-release-pipeline