devops-platformlisted

# DevOps and Platform Engineering Two questions decide whether a platform is professional: > **How long from commit to production?** > **How long from "this is broken" to it not being broken?** Everything below serves those two numbers. A pipeline that produces neither speed nor reversibility is ceremony. --- ## Reproducibility — the precondition If the environment cannot be rebuilt from the repository, everything else is built on sand. - [ ] Runtime version pinned in a file the toolchain reads, and in the manifest. - [ ] Lockfile committed; CI installs **frozen** (`npm ci`, `--frozen-lockfile`, `poetry install --sync`, `bundle --deployment`). - [ ] Container base images pinned **by digest**, not by a moving tag. - [ ] Infrastructure in code, in the repository, applied by the pipeline. - [ ] **No snowflake servers.** Anything configured by hand once is a single point of failure with no recovery procedure. The test: could you delete the production environment and rebuild it from the repo? - [ ] Local development one command away — Docker Compose, devcontainer, or a documented single script. --- ## The pipeline **On every pull request**, blocking merge: ``` install (frozen) → lint → typecheck → unit → integration → build → dependency audit → secret scan ``` **On merge to the default branch:** ``` build once, tag by commit SHA → deploy to staging → smoke tests → ready for production ``` Rules that matter more than the tool: