Delivery processes

A comprehensive catalog of tools and technologies used in the delivery pipeline, organized by process area with status tracking and implementation details.

The Delivery Processes Catalog provides a comprehensive list of tools and technologies used in the delivery pipeline.

New technologies can be introduced by preparing a “spike” that identifies the need, establishes clear acceptance criteria, and builds a provable case that adding the new technology provides a significant benefit exceeding the cost of doing so.

For this activity, refer to chapter 2.8 Delivery processes & tools as a guide. As technologies are adopted, keep your service catalog up to date. Use the tags Proposed, Under review and Approved to reflect the current status of each catalog entry.

Delivery processes map

The following drawing provides a high-level map and identifies different processes you’ll want to think about.

Service catalog

The following table identifies products and technologies used in the delivery pipeline, and where appropriate indicate a priority for implementation.

New entries should be added with a Proposed tag and must be reviewed and approved by the Architecture Review Board.

Process	Status	Functional Area	Implementation
Manage
Audit Events	Proposed P2	Observability	Business intelligence on auditable events in the system. OpenTelemetry Grafana
Audit Reports	Proposed P2	Observability	Business reports (offline) summarizing business intelligence …
Compliance Management	Proposed P2	Compliance	Compliance process management platform Vanta
Operational Visibility	Proposed P2	Observability	Supports live visibility into operational data (runtime, data flow, business intelligence) OpenTelemetry Grafana
…
Plan
Issue Tracking	Under review P1	Incident Management	Supports tracking of bugs and defects JIRA
Design Management	Under review P1	Asset Management	Centralized, version controlled repository that contains all design assets Confluence
…
Create
Source Code Control	Approved P1	Asset Management	Manage and secures source code GitLab
Code Review	Approved P1	Development	Facilitates pull request / source code review GitLab (see also: handbook)
Peer Review	Approved P1	Development	Facilitates peer review and pull request management GitLab
Common Repository	Approved P1	Development	Facilitates unified access to code with role based permissions GitLab
Ephemeral Environments	Approved P1	Infrastructure Management	Facilitates automated environment setup/teardown GitLab (see also: handbook, review apps) Terraform
…
Verify
Continuous Integration	Approved P1	Build Management	Automated build post-merge with escalating deployment to higher environments using IaC GitLab
Code Testing and Coverage	Under review P1	Development	Automated testing framework and code coverage analysis (language dependent) SonarQube

Package
Package Registry	Approved P1	Build Management	Publishes and shares packages as dependencies in downstream projects GitLab
Container Registry	Approved P1	Build Management	Stores container images for projects GitLab
Dependency Management	Under review P1	Build Management	Manages dependencies to external packages and containers within the project (language specific) …
Release Evidence	Approved P1	Build Management	A JSON file containing a snapshot of data (packages, containers, code versions) related to a build GitLab
…
Secure
SAST	Approved P1	Security	Static application analysis (source detection, sink detection, cross-function analysis, cross-file analysis, etc.) GitLab
Secret Detection	Approved P1	Security	Scans code for hardcoded secrets GitLab
Code Quality Analysis	Approved P1	Security	Analyzes code with language-specific models to improve quality and avoid anti-patterns GitLab SonarSource
DAST	Under review P2	Security	Dynamic application security testing GitLab Orca
Fuzz Testing	Under review P2	Security	DAST-style random input testing to harden an application GitLab
Dependency Analysis	Under review P2	Security	Scans dependencies for known vulnerabilities GitLab
…
Release
Continuous Delivery	Approved P1	Build Management	Automated software release GitLab
Review Apps	Approved P1	Build Management	Environments that are automatically provided to showcase product changes GitLab
…
Configure
Secrets Management	Under review P1	Security	Secure repository to manage secrets Hashicorp Vault
Infrastructure as Code	Under review P1	Infrastructure Management	Automated configuration, management, set-up and tear-down of infrastructure Terraform
…
Monitor
Operational Observability	Under review P2	Monitoring	Monitor current server and application state metrics Dynatrace OpenTelemetry Grafana
Telemetry	Under review P2	Monitoring	Federated metrics and log data collection OpenTelemetry
Integrated Dashboard	Under review P2	Monitoring	Visualization dashboard to provide real-time data on server, application, infrastructure, and business metrics Grafana Prometheus
…
Protect
Container Scanning	Approved P1	Security	SAST vulnerability scans on containers (including 3rd party containers) GitLab
…