Ensuring the CI/CD Pipeline Is the Sole Path to Production

Continuing to send immutable artifacts and deployments to production, we must also ensure the pipeline itself is the only path to production.

The primary intended use of CI/CD pipelines is to ensure the CI/CD platform is the only one that can deploy applications to production. This practice guarantees that the production environment runs exactly what is intended (i.e., the last artifact deployed).

Unfortunately, some organizations either allow developers to deploy directly from their local machines, or even inject their artifacts into the pipeline at different stages.

This is a very dangerous practice because it breaks the traceability and monitoring provided by a proper CI/CD platform. It allows developers to deploy features that may not have been committed to source control initially. Many failed deployments stem from missing files that exist only on the developer’s workstation, not in source control.

In summary, there is only one critical path for deployment, and this path is strictly controlled by the CI/CD platform. Deploying production code from developer workstations should be prohibited at the network/access/hardware level.

The article is part of a series on enterprise DevOps practices, with links to previous posts covering topics such as test suite duration, automated testing, artifact management, and short‑lived feature branches.