---
title: "CI/CD and release promotion"
description: "Trace a release from GitHub through GitLab and Dev to an Owner-approved production deployment."
---

> Documentation Index
> Fetch the complete documentation index at: https://status.nextvisions.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# CI/CD and release promotion

GitHub is the source of truth. GitLab tests and builds immutable images; Argo CD applies the GitOps desired state. CI never receives a production kubeconfig.

## Development

Push `dev` to synchronize the exact commit to GitLab. Tests run against disposable dependencies. A candidate records the source commit and tree, control revision, pipeline and image digests. Dev must pass its full Argo operation, PostSync checks and a public check from a GitHub-hosted runner.

The Dev suite creates isolated QA organizations and captures email in Mailpit. It tests members, plans, customer branding, MCP keys and stale snapshots while an isolated API cannot reach its database. It does not disconnect the shared database service.

## Production

Merge the accepted content into `main`. The designated Owner starts the manual promotion job. The job verifies the actor and Dev evidence again, compares Git trees and deploys exactly the same image digests. A merge commit may have a different SHA; differing content requires a new Dev candidate.

Production remains pending until PostSync and external public acceptance pass. A failed hook does not mean workloads were never updated or automatically rolled back.

## Configuration and recovery

Use separate database, Redis, object storage and credentials for each environment. Docs run under `/docs/`; frontend environment settings are supplied at runtime. Cloudflare SMTP uses implicit TLS on port 465; keep credentials in Secrets and rotate them before expiration.

Recover by committing the previous verified image and configuration bundle to the correct GitOps branch, followed by full sync and fresh acceptance. Image rollback does not undo migrations or restore data. Keep release records and retained image digests for review and recovery.

See the repository's `docs/devops/` runbook for environment mappings, credential scopes, first installation and actual verification results.

## Cluster bootstrap prerequisites

The shared cluster requires a namespace-scoped Argo writer Role and a read-only
log Role for the Status namespaces. CI has no Kubernetes token. Longhorn blocks
volumes with empty node/disk selectors: operator-provisioned Status volumes use
the `nextvision-status-storage` selector and `longhorn-1r`. Production Redis
uses a prebound 10 GiB Retain PV/PVC. PostgreSQL NetworkPolicy permits only the
environment's compute Pod on 5432 after NodePort DNAT, with verified TLS unchanged.

Control v1 is retained; v2 contains the bootstrap network correction and
idempotent GitOps retry. GitHub private branch protection is unavailable on the
current account tier; GitLab protections remain enabled. Never make the repo
public or purchase a plan as a deployment workaround.

Control v3 adds the eight verified /32 addresses (node IP and Calico tunnel IP for each of four Traefik hostNetwork nodes) on web/docs/API ports. Temporary bootstrap repair policies are removed after the GitOps policy is active.

Migration 011 gives the trusted schema-owner pool an explicit system policy while FORCE RLS continues to constrain `status_runtime`. Application integration tests use an actual LOGIN role without SUPERUSER or BYPASSRLS. The non-root libpq client has its own disposable PostgreSQL regression job.

Source: https://status.nextvisions.ai/docs/en/ci-cd/index.mdx