Field note
When a green build still needs a babysitter
How to spot human gates that CI reports as success—and what to ask in a pipeline audit when overnight laptops keep showing up in the release story.
A pipeline can be “green” and still require someone to copy an artifact, click a vendor console, or leave a machine unlocked so a cron job can reach a VPN. Those steps rarely appear in the YAML. They appear in chat logs the morning after a failed train.
Questions that surface babysitting
- What happens if the usual releaser is on leave this Friday?
- Which credentials exist only in a password manager entry titled with a person’s name?
- Which job is marked optional because it fails too often to block the train?
During a CI/CD pipeline audit, we treat unanswered versions of those questions as findings—even when every required stage shows a checkmark.
A practical first cut
List the last five production deploys and write, beside each, the names of people who performed a manual step. If the same two names appear every time, you have a concentration risk that no coverage percentage will reveal.
Enablement work later can redistribute those steps. The audit’s job is to make them visible without shame and without pretending the dashboard already told the truth.