Release Framework Rollout
Standardized versioning, deployment, and secrets governance across six engineering teams.
01 — The problem
Six teams — five in the Philippines, one in Japan, thirty-plus engineers — each with their own branching habits, their own idea of what a version number meant, and their own way of getting secrets onto a server. Nobody could answer 'what's in production right now' without asking three people, and every deploy carried the risk of a credential ending up somewhere it shouldn't.
02 — Constraints
Adoption had to happen without halting delivery on any team.
Teams spanned time zones and languages — the process had to work asynchronously.
Existing repositories couldn't be rewritten; the framework had to meet them where they were.
Secrets governance had to improve without adding a ticket queue.
Mandates don't stick. Ownership does.
03 — Architecture
One release contract
SemVer, a defined branching strategy, and on-demand deployment workflows applied uniformly across every repository — so a version number means the same thing regardless of which team produced it, and 'what's in production' is a query rather than a conversation.
Secrets pipeline with rollback
Infisical fronting AWS Secrets Manager, with defined rollback procedures. Credentials stop living in CI variables and developer laptops, and a bad rotation is recoverable in minutes instead of being an incident.
Governance by release champions
Each team nominates a release champion who owns the process locally. The framework spreads through peers rather than through a mandate from delivery — which is the only reason it survived contact with six different team cultures.
Security scanning in the default path
StepSecurity, CodeQL, Trivy, Gitleaks, Semgrep, and Legitify wired into GitHub Enterprise so scanning is what happens by default, not what happens when someone remembers. Findings land in the same place engineers already work.
04 — Outcome
A single, predictable release process across six teams and two countries.
Secrets moved out of ad-hoc storage into a governed pipeline with rollback.
Security scanning became the default path rather than an opt-in step.
Execution visibility improved enough that risk surfaces early instead of at release.