3 ms·
We have CI/CD but we still use our QA department. We have production permissions given to DevOps only so they must approve the pipeline, Developers cannot push
by galleywest200 3y ago
We have CI/CD but we still use our QA department. We have production permissions given to DevOps only so they must approve the pipeline, Developers cannot push to it. Dev hands off to QA, QA then hands off to DevOps.
When we went for SOX compliance our auditors were pretty firm that having developers being the ones pushing to prod and not a separate team was a security issue.
- seneca 3y ago> When we went for SOX compliance our auditors were pretty firm that having developers being the ones pushing to prod and not a separate team was a security issue. That's surprising to hear. That's a very out of date take on SOX, in my experience. I've worked in thoroughly audited FedRAMP environments where the it's devs pushing and reviewing that triggers pipelines for prod release.
- MattGaiser 3y agoI’d argue that all meaningfully qualifies as CI/CD as long as there isn’t someone manually mucking with a command line. A pipeline of who gets to push to prod isn’t a big mistake prone deal.