---
title: "Delivery and software supply chain"
chapter: "12"
---

# Delivery and software supply chain

A secure deployment proves what code became what image, who approved it, and
what is running now.

## The path

1. Developer changes reviewed source.
2. CI runs tests, dependency checks, and policy checks.
3. A controlled builder creates the image.
4. The image is scanned and stored in ECR.
5. The release references an immutable digest and provenance.
6. Admission policy accepts only approved artifacts and workload settings.
7. Progressive delivery sends limited traffic first.
8. SLO evidence decides promotion or rollback.

Use short-lived CI federation such as OIDC instead of repository access keys.
Separate build, deploy, and approval permissions. Protect production branches
and environments.

## Rollouts

Set `maxUnavailable` and `maxSurge` from actual capacity. Readiness must reflect
the user path. Canary or blue/green releases reduce blast radius only when
metrics and rollback are reliable.

## Database changes

Use expand-and-contract migrations: add compatible schema, deploy code that
works with both versions, migrate data, then remove the old schema later.

## Feynman check

An image tag is a label that can move. A digest is the parcel's fingerprint.
For rollback and forensics, deploy the fingerprint.