# Software Deployment Checklist

Source: https://goreplay.org/blog/software-deployment-checklist/

## Pre-deployment

- [ ] Release scope is frozen and every change in it is linked to a ticket or PR
- [ ] Code is reviewed and merged; the CI build and full test suite are green on the exact commit you'll ship
- [ ] The release artifact (image, package) is built once, versioned and stored; nothing is rebuilt for production
- [ ] Configuration and secrets for the target environment are checked against what the new version expects
- [ ] Database migrations are backward compatible with the currently running version and have been run on a staging copy
- [ ] A fresh backup or snapshot exists and a restore has been tested recently
- [ ] The rollback plan is written down: the exact command or pipeline step, who runs it, and how long it takes
- [ ] The new build has been tested against realistic traffic (load test or replayed production requests)
- [ ] Security scans (dependencies, container image, secrets) have passed or exceptions are approved
- [ ] Dashboards and alerts for error rate, latency and saturation are ready, with a baseline from before the release
- [ ] Stakeholders, support and on-call know the deployment window and the expected impact

## During deployment

- [ ] Announce the start in the team channel and pause other changes to the same system
- [ ] Run migrations first (expand step), then deploy the application
- [ ] Roll out gradually: canary, a percentage of traffic, or one region or node group at a time
- [ ] Run smoke tests against the new version before widening the rollout
- [ ] Compare error rate, latency and key business metrics against the baseline at each step; stop and roll back if they cross the agreed thresholds

## Post-deployment

- [ ] Confirm all instances run the new version and the old ones are drained
- [ ] Watch dashboards and logs for at least one full traffic cycle (typically an hour, longer for batch-driven systems)
- [ ] Verify critical user journeys end to end (sign-in, checkout, core API calls)
- [ ] Remove temporary feature flags or schedule their cleanup
- [ ] Run the contract step of any expand/contract migration only after the old version is gone
- [ ] Record the deployment: version, time, issues seen, and anything to change in the checklist