Deployment strategy

Status: Accepted — ADR-0007. Implementation tracked under Epic F #51.

Companion: Release strategy · Rollback · PROD runbook

---

Split of responsibility

Layer	Role
GitHub Actions	Quality gates (lint, tests, guards). Optional manual deploy orchestration (workflow_dispatch).
AWS CodePipeline	Build/push images + deploy ECS (API / Frappe).
AWS Amplify	Build/deploy frontends (admin, customer apps).

Rule: a git push alone must not deploy DEV or PROD (target state: disable triggerOnPush; start pipeline from Actions — F.1 #52).

---

Environments

Env	Typical git ref	How it ships
Shared DEV	feature/TASK-* or develop	Manual workflow → CodePipeline DEV + Amplify DEV; confirm overwrite required for shared DEV
PROD	release/x.y.z only	Manual workflow with confirm_prod=deploy; Amplify promote/deploy same ref (F.3 #57)

---

DEV deploy (optional)

Use when a feature needs shared DEV validation before merge to develop.

1. Branch exists: feature/TASK-{id}-…
2. CI green on the branch / PR.
3. Run deploy workflow (workflow_dispatch) targeting dev.
4. If another developer’s work is on shared DEV, set the explicit confirm_overwrite_dev (or equivalent) — no silent stomps.
5. Validate; then PR → develop.

---

PROD deploy

1. Cut release/x.y.z from develop (release strategy).
2. Run deploy workflow targeting prod from that release ref only.
3. Confirm prod explicitly (confirm_prod=deploy).
4. Smoke-test; then PR release → main and tag.

Guards (target):

• Prod cannot start from feature/*
• Ref must match release/* for prod
• See F.4 #58

---

Image / artifact identity

Prefer immutable tags (F.2 #53):

• sha-<git-sha>
• build-<github-run-number> (optional companion)

Never deploy an ambiguous latest to PROD.

---

CDK / env guardrails

Infra changes still follow ../CDK-ENV-GUARDRAILS-DEV-PROD.md. Deploying app code and changing CDK stacks are separate decisions — do not bundle accidental prod infra with a routine app release.