DevOps Automation Checklist for Web Development

Use GitHub or GitLab branch protection to require PRs, status checks, and block force pushes. Enable auto merge when checks pass to keep trunk based flow fast and predictable.

Add commitlint and a commitizen adapter to validate commit messages in local hooks and CI. This enables semantic-release to automate versioning, changelogs, and package tags.

Use lint-staged with Prettier and ESLint for JS and TS, and pre-commit for Python to run black, isort, and flake8. Add Gitleaks or TruffleHog to block secret leaks before they hit CI.

Adopt Nx or Turborepo to cache and skip work for unchanged packages. Configure task pipelines so shared libs build once and downstream apps reuse artifacts.

Check in .nvmrc or .node-version and .python-version, and enforce pnpm-lock.yaml or yarn.lock plus poetry.lock or pip-tools. CI should use the exact versions to avoid environment drift.

Define path based owners and require at least one code owner review. Use rules to auto request reviewers to reduce bottlenecks on familiar code paths.

Cache pnpm or yarn and pip directories keyed by the lockfile hash, with a restore key fallback. This cuts cold build times without risking stale dependencies.

Split install, build, and runtime stages to keep final images small and leverage layer caching. Enable BuildKit and cache mounts so node_modules and pip caches persist across runs.

Use a CI matrix for Node and Python versions and shard Jest, Vitest, or Pytest across runners. Balance shards by historical timing to cut wall clock time.

Enable retry plugins for Cypress or Playwright and use tags to quarantine known flakies. Emit a report so owners can fix regressions without blocking healthy PRs.

Aggregate coverage with nyc or Jest and Coverage.py, then publish to Codecov or SonarQube. Fail the build when coverage dips below a threshold for critical modules.

Factor common jobs into composite actions or reusable workflows to standardize bootstrapping, caching, linting, and tests. This keeps pipelines DRY and easier to harden.

Run ESLint, Stylelint, and tsc with noEmit for strict TS checking, and fail on errors. Catch front end regressions early before browsers render them.

Scan application code for injection and auth issues on each PR, plus deeper nightly scans. Treat findings as blocking when rules hit high confidence and severity.

Use Snyk, Trivy, or Grype to scan package locks and Docker images. Block merges on high severity CVEs and auto create upgrade PRs with pinned fixes.

Run Gitleaks or TruffleHog locally and in CI to prevent API keys and tokens from landing in git. Auto revoke via provider APIs when a leak is detected.

Integrate Playwright or Cypress with Percy or Chromatic to snapshot UIs and detect pixel diffs. Block merges on meaningful visual changes unless approved.

Validate OpenAPI with Dredd or Newman against staging and compare schemas with openapi diff. Fail if breaking changes are introduced without a version bump.

Store VPC, databases, caches, queues, and CDN as code and run plan in CI for every change. Post plan output to the PR for peer review before apply.

Write guardrails to prevent public buckets, weak TLS, or open security groups. Enforce policies in CI so bad infra never reaches production.

Load env vars from AWS SSM, Vault, or Doppler and inject them at deploy time. Ban committed .env files and rotate secrets automatically on a schedule.

Use minimal base images, create a non root user, and copy only built artifacts. Sign images with cosign and attach SBOMs for traceability.

Spin up a namespace or Docker Compose stack for every PR and post the URL as a comment. Auto destroy the environment on merge or close to control costs.

Run Prisma, Flyway, or Liquibase migrations in CI against staging with a dry run, then prod with backups. Block deploys when destructive changes lack an approved plan.

Use Argo Rollouts or Flagger with feature flags from LaunchDarkly or Unleash to ramp traffic. Auto rollback if error rate or latency crosses SLO thresholds.

Drive version bumps and release notes with semantic-release for npm packages and Docker tags. Attach SBOMs generated by Syft to each artifact for compliance.

Use k8s rolling updates with readiness and liveness probes or PM2 for Node to avoid restarts that drop connections. Fail deploys fast when health endpoints regress.

Build and fingerprint assets, upload to S3 or a static host, and purge CDN caches on release. Avoid stale JS by enforcing cache busting on every deploy.

Schedule terraform plan or Argo CD sync checks and post drift alerts to chat. Restore desired state automatically or require approval for high risk changes.

Run scheduled DB and object store backups with checksum verification, then test restores in staging. Track recovery time and document the steps in runbooks.

Instrument backend APIs and frontends to emit spans, metrics, and logs, then export to Prometheus, Grafana, Jaeger, or Datadog. Add trace IDs to logs for deep correlation.

Emit JSON logs with request IDs and user context and ship them to Loki or ELK. Create saved searches for 4xx and 5xx spikes and link them to alerts.

Integrate Sentry or Rollbar with the CI pipeline to set release versions, source maps, and commits. Auto assign issues to owners via CODEOWNERS for fast triage.

Manage Prometheus alert rules or Datadog monitors in git and sync to PagerDuty or Opsgenie schedules. Test alerts in staging and include runbook links in annotations.

Trigger scripts to roll back canaries, restart pods, or scale out on threshold breaches. Keep playbooks versioned in the repo and simulate them monthly.

Capture deployment events, lead time, and failure rates from CI and CD and publish weekly dashboards. Use trends to tune batch size, approvals, and rollback policies.