Haseeb ArshadHaseeb Arshad
← All projects
Delivery engineeringProduction

GitOps Delivery and Immutable Releases

A source-to-production pipeline that builds containers, resolves immutable image digests, validates desired state, and lets Argo CD perform controlled rollouts.

GitHub ActionsGHCRArgo CDKubernetesPythonBash

100%

digest-pinned images

3

website replicas

5 min

release detection

The challenge

What the system needed to solve

Make every deployment traceable and reversible without hand-editing live workloads or trusting mutable container tags in production.

The build

Engineering decisions

01

Created independent CI pipelines that test and publish commit-addressed images for each first-party application.

02

Built scheduled GitOps workflows that resolve production tags to immutable SHA-256 digests and update the desired-state repository.

03

Added repository-wide validation, generated-manifest checks, image-policy scans, and feature-level contract tests before changes can ship.

04

Used rolling updates, readiness probes, and Argo CD health checks as the deployment handoff between CI and the cluster.

Architecture

How the pieces connect

  1. 1Source commit
  2. 2CI test and container build
  3. 3GHCR immutable image
  4. 4GitOps digest update
  5. 5Argo CD rolling deployment

Results

What changed

  • Production state can be reconstructed from Git history and container digests.
  • A failed release can be diagnosed at the exact source, image, manifest, and rollout revision.
  • The same delivery pattern now serves websites, internal tools, automation services, and custom platform components.