Webhook Delivery Service  ·  View 16 of 20  ·  Operations

Release Pipeline

Three gates that exist because of what this platform is, and a rollout that drains.

Editable source SVG draw.io All views
Source Service and IaC Repo Terraform + code Build CI Build image + SBOM Unit and Contract Tests Gate Signature Contract canonical string frozen Address Guard Suite rebinding, redirects Egress Range Review published interface Stage Staging Delivery Plane synthetic endpoints Slow and Dead Endpoints injected every run Canary 5% of Workers 30 min soak Success-Rate Watch auto-rollback Production Rolling Workers drain in-flight, 20 s Queue and Policy Config versioned, staged promote or roll back Release Pipeline and the Egress Contract Application we own Security / platform Decision point failure / alternate A worker is drained, never killed: an in-flight attempt finishes, or its message returns on the visibility timeout. v 1.0 · owner Integration Platform Architecture · date 2026-09

The three gates

  • Signature contract test: the canonical signed string is frozen by a test, because changing it silently breaks every consumer's verification at once (ADR-06).
  • Address guard suite: DNS rebinding, redirect chains, scheme downgrade and private-range resolution, run on every build. This is the control that stops the worker fleet becoming an internal request forwarder.
  • Egress range review: a change to the published NAT ranges is a breaking change to a public interface and goes through the same review as an API change (ADR-11).

Rollout

  • Staging injects deliberately slow and deliberately dead endpoints on every run, because the interesting behaviour of this platform is entirely in how it handles consumers that misbehave.
  • Canary on 5% of workers with a 30-minute soak watched on delivery success rate, with automatic rollback.
  • Workers drain rather than being killed: an in-flight attempt completes, or its message returns on the visibility timeout. A 20 s drain against a 15 s attempt timeout.

Assumptions

  • 5% canary, 30-minute soak and 20 s drain are stated assumptions sized against the attempt timeout, not measurements.
  • Queue and policy configuration is versioned and staged like code, which matters most for the retry schedule and the concurrency caps.
◀  Deployment Architecture All views Observability  ▶
Solution Architecture v1.0 · Amazon Web Services · Integration Platform Architecture · 2026-09 · 20 views · 16 architecture decision records16-release-pipeline