Release Pipeline Audit (QA)

Release Pipeline Audit (QA)

1. 01

   Map every active deployment path from repository to production

   List each client project's CI/CD chain, including the triggering event, build steps, and target environment. Note any manual interventions that have crept into the process.

2. 02

   Verify rollback capability for each deployment target

   Confirm that a one-click rollback or versioned artifact exists for every environment. Test the rollback on a staging instance to ensure it restores the previous state within the expected window.

3. 03

   Check that secrets and credentials are stored outside the codebase

   Scan repositories for hardcoded API keys, database passwords, or tokens. Move any found secrets into the platform's secret manager or an external vault, then rotate them immediately.

4. 04

   Confirm zero-downtime deployment settings are active where clients require it

   For client sites that cannot tolerate downtime, verify that the deployment tool uses rolling updates or blue-green strategies. Test a deployment during a low-traffic window to measure actual interruption.

5. 05

   Review build and test automation coverage for the highest-risk changes

   Identify the projects with the most frequent releases or the largest blast radius. Ensure automated tests run in the pipeline and that a failed test blocks the deployment.

6. 06

   Document the audit findings and flag any tool that lacks programmatic access

   Record which platforms expose APIs or MCP endpoints for future automation. Flag any service that only offers a web UI, as it will block agent-based workflows and complicate scaling.