mirror of https://github.com/magnus919/agent-skills.git synced 2026-09-16 22:16:52 +03:00

Files

T

usernameandfactory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com> 6730015312 feat(release-engineering): add release engineering skill bundle

Dense release engineering methodology bundle: 15 references (role/career, process models,
CD pipelines, progressive delivery, change governance/compliance, readiness gates, rollback
by system type, versioning/artifacts, feature flags, monorepo/polyrepo, toolchain,
supply-chain security, DORA metrics, release operations), 6 templates, 4 assets, 5 stdlib-only
Python CLIs (version_bump, semver_check, changelog_check, dora_metrics, release_plan_scaffold)
with colocated tests, schema-v1 evals (8 cases), README, and catalog regeneration.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

2026-08-01 22:54:13 -04:00

18 KiB

Raw Blame History

The Release Engineering Toolchain Landscape (2025–2026)

A practitioner's catalog of the tools release engineers actually use, organized by category, with current status, alternatives, and selection guidance. Adoption figures come from the JetBrains State of Developer Ecosystem 2025 survey (cited below) and vendor/CNCF documentation; treat percentages as directional, not precise. For a one-screen cheat sheet, see ../assets/release-toolchain-cheatsheet.md.

CI/CD Orchestration

Tool	Status (2025–2026)	Best for	Alternatives
GitHub Actions	Leader: ~33% org adoption; 20K+ marketplace actions; Copilot integration	Default for GitHub-hosted code and new projects	CircleCI, Buildkite (speed); GitLab CI (integrated security)
Jenkins	~28% org adoption; actively maintained; biggest CloudBees update in a decade	Air-gapped, regulated, legacy environments; Groovy pipelines	GitHub Actions Importer supports migration (70–90% accuracy)
GitLab CI/CD	~19% org adoption; leader in integrated DevSecOps (SAST/DAST/dependency scanning in Ultimate); native DORA metrics	Teams wanting a single-platform VCS+CI+security	GitHub Actions, Azure DevOps
CircleCI	Active; ML-powered test splitting cuts build times 50–70% (vendor-reported)	Test-heavy pipelines (Ruby, Python, JS)	GitHub Actions, Buildkite
Buildkite	Active; hybrid model (managed control plane + self-hosted agents)	Enterprises wanting control without full self-hosting	GitHub Actions self-hosted runners
Azure DevOps Pipelines	Active; deep Azure/.NET integration	Microsoft-stack enterprises	GitHub Actions (increasingly preferred even at Microsoft)
Tekton	Active CNCF project; K8s-native building blocks	Platform teams building custom CI on Kubernetes	Jenkins X (built on Tekton), Dagger
Dagger	Active; pipelines-as-code in Go/Python/TS; containerized execution; absorbing Earthly users	Portable, testable pipeline logic that runs on any CI	Earthly (winding down), Bazel for builds

Trends: pipeline-as-code in version control is non-negotiable; self-hosted runners for cost/control with cache optimization as the top lever; DORA dashboards built into platforms (GitLab native, Datadog, CircleCI); AI entering pipeline authoring and debugging. Note that ~18% of organizations still use no CI/CD at all — the adoption gap is real and is the first thing to fix in low performers.

Gotcha — the "era of defaulting to Jenkins for everything is over": Managed CI compute is cheaper than engineer time for most teams, and Jenkins' strength (total self-hosting control) is its weakness (fleet maintenance, plugin sprawl). Default to managed CI unless you have a hard reason (air-gap, regulation, existing investment) to self-host.

Quick decision rule for CI/CD selection:

If you are...	Default choice	Reconsider when
On GitHub, starting fresh	GitHub Actions	You need specialized test compute (CircleCI/Buildkite) or cross-repo pipeline portability (Dagger)
On GitLab, wanting one platform	GitLab CI/CD	You need the deepest multi-platform runner control
Air-gapped / regulated / legacy	Jenkins (or Buildkite hybrid)	Migration tools (GitHub Actions Importer) now cover 70–90% of pipelines
Building a custom K8s-native CI platform	Tekton or Dagger	Your team lacks the platform-engineering depth to operate the layer
.NET/Azure enterprise	Azure DevOps Pipelines	Your org is standardizing on GitHub anyway

Release Automation and Versioning

Tool	What it automates	Model	Notes
semantic-release	Version bump + changelog + publish + GitHub release/tag	Fully automated, no human gate	Mature plugin ecosystem; npm/JS-native but extensible
release-please	Release PRs with changelog + version bump	Auto-generates PR, human merges	Google's model; strong monorepo support; GitHub Action
changesets	Developers write changeset files; tooling aggregates into changelog + bump	Intentional, per-PR declaration	Popular in pnpm/yarn workspace monorepos
release-drafter	Drafts GitHub release notes from PR labels/titles	Notes only, no versioning	Simple; pairs with manual tagging
git-cliff	Generates CHANGELOG.md from git history (conventional commits)	Changelog only, highly configurable	Rust-based; language-agnostic

The ecosystem is converging on the "generate a release PR, human approves" model (release-please) over fully automatic publishing — the human gate stays on the merge, not on the version math. Conventional Commits is the shared foundation underneath all of them. The three leading tools occupy a useful automation spectrum:

Tool	Human gate	Who declares impact	Monorepo story	Best when
semantic-release	None (publishes automatically)	The commit message	Via plugins	You trust your commit discipline completely and want zero-touch npm/package publishing
release-please	Yes — a release PR to merge	The commit message	Strong (manifest mode)	You want automated changelog + version math but a human to eyeball the release PR
changesets	Yes — per-PR changeset files	The developer, at PR time	Strong (pnpm/yarn workspaces)	You want intentional, developer-declared impact and grouped monorepo releases

A common trap is reaching for semantic-release when the team's commit hygiene cannot support it — if feat:/BREAKING CHANGE: are not enforced at review time, the automation will silently produce wrong versions. Enforce Conventional Commits in CI before automating on top of it.

Build Systems and Dependency Managers

Bazel — hermetic, reproducible builds with remote execution and caching; the standard for large polyglot monorepos; steep learning curve. Alternatives for JS/polyglot: Nx, Turborepo, Pants, Buck2.
Nix — declarative, reproducible system-level packaging; complements Bazel (Nix for system-level environments, Bazel for project builds); nix develop is displacing Docker for dev environments in some shops.
uv — the rising Python package/project manager (Rust-based; 85K+ GitHub stars; 8–100x faster than pip per Astral). It is displacing pip/Poetry/pip-tools/pyenv as a single tool and can import existing Poetry projects. Poetry remains active but is being challenged.
Gradle — JVM build system with build cache and configuration cache; preferred for new Android/JVM projects over Maven.
Lockfiles are universal: package-lock.json, Cargo.lock, go.sum, uv.lock — every ecosystem now expects them. Reproducible builds are a requirement, not a nice-to-have — but note the caveat: an IEEE Software 2025 study found even Bazel-using OSS projects rarely achieve full hermeticity, so verify, don't assume.

Artifact Registries

Tool	Status	Best for
JFrog Artifactory	Market leader; 40+ formats incl. OCI; Xray for security	Enterprise single source of truth across formats; on-prem/multi-cloud
Sonatype Nexus	Active; OSS + Pro	Java-heavy enterprises; open-source alternative to Artifactory
GitHub Container Registry (GHCR)	Active; free tier; integrated with Actions	GitHub-native teams; displacing Docker Hub for OSS
Docker Hub	Active; anonymous-pull rate limits	Public default image distribution
AWS ECR / Google Artifact Registry / Azure ACR	Active; cloud-native	Cloud-locked teams; built-in scanning
Harbor	CNCF graduated; self-hosted OCI registry with Trivy scanning, RBAC, replication	Self-hosted registries with security built in

The convergence point is OCI: containers, Helm charts, SBOMs, WASM, and even ML models are all moving to OCI format, so registry selection is increasingly a question of where your OCI artifacts live, not which formats you support. Registry-level security (scanning, SBOM attach, policy) is becoming the norm.

Gotcha — the registry is a security boundary and a DR liability: A registry without backup/DR is a single point of failure for every release. If you use a checksum-deduplicated store (like Artifactory's), you must back up both the metadata database and the filestore — and the master/signing keys — or recovery is impossible. See release-operations-and-triage.md.

Deployment and Progressive Delivery

Argo CD and Flux — both CNCF graduated; the de facto standard for GitOps CD on Kubernetes. Argo CD: web UI, multi-cluster, RBAC/SSO; Flux: lighter, controller-based, CLI-driven, good for air-gapped. GitOps is winning for K8s; push-based CD (pipeline deploys to targets) still dominates for VMs, serverless, and legacy.
Argo Rollouts — progressive delivery for Argo users (canary, blue-green, experiments, metric-based analysis); integrates with service meshes.
Flagger — progressive delivery operator for Flux users; metric-based canary analysis with Istio/Linkerd/NGINX/etc.
Spinnaker — declining: Netflix-originated, complex to operate, community-maintained; being displaced by Argo CD/Harness/GitOps patterns.
Harness — enterprise CD with AI deployment verification and auto-rollback, feature flags, and policy/governance; overkill for simple setups.
Octopus Deploy — strong in the .NET/Windows enterprise; multi-environment orchestration and runbooks; less relevant for cloud-native/K8s.

Trends: canary + blue-green with metric-gated auto-rollback is no longer optional for production services; progressive delivery is the default pattern, and feature flags decouple deploy from release (deploy continuously, release deliberately).

Feature Flags

LaunchDarkly — enterprise market leader; server-side + client-side SDKs; experimentation platform; expensive and proprietary.
Flagsmith, Unleash — open-source, self-hostable flag platforms; Unleash has strong community and GitLab integration; both are OpenFeature-compatible.
ConfigCat — budget-friendly managed flags with 10+ SDKs.
OpenFeature (CNCF) — the vendor-neutral SDK standard; providers implement backends, so application code is not locked to a vendor. Adopt it if you want to avoid flag-tool lock-in.

See feature-flag-lifecycle.md for the lifecycle discipline (naming, ownership, expiry, cleanup) that makes any flag tool safe.

Release Observability

Release markers: Sentry releases (error-to-release correlation, crash-free rate), Datadog deployment markers (version-tagged traces, DORA metrics product), Grafana annotations (deploy events on dashboards).
Metric gates: Argo Rollouts/Flagger analysis, error-budget-based release gating (halt non-P0 releases when a service exceeds its 4-week error budget — the Google SRE pattern).
DORA dashboards are now built into GitLab, Datadog, CircleCI, and Harness; manual metric tracking is being replaced by platform-native reporting. See metrics-and-dora.md for the exact definitions and the vendor-formula caveats.

The common pattern across every tool: every deploy creates a marker, and release health questions ("is the error rate up since 14:02?") are answered from version-tagged data rather than hunches.

Tool	Marker type	Typical use
Sentry releases	Release versions on error events	Regression detection, crash-free rate, suspect commits
Datadog deployments	Version-tagged traces + dashboard markers	Performance impact per deploy; DORA product
Grafana annotations	Time-series deploy events	Visual correlation of deploys with metric changes
Argo Rollouts / Flagger analysis	Metric queries against rollout phases	Automated canary pass/fail and auto-rollback

Security Tooling

SBOM generation: Syft (deepest cataloger coverage for binary analysis), Trivy (all-in-one: SBOM + vulnerability + misconfig + secrets), CycloneDX CLI (build-time accurate, monorepo merging, native VEX).
Signing: Cosign/sigstore (keyless OIDC signing + Rekor transparency log — the standard for OCI); Notary/Notary v2 (legacy Docker content trust, declining).
Dependency updates: Renovate (90+ package managers, multi-platform, grouping/scheduling) vs. Dependabot (GitHub-only, zero-config). Every active project should have one.
Standards: SLSA v1.0 (build/source provenance levels), SPDX 3.0 / CycloneDX 1.6 formats, OpenSSF Scorecard.

Gotcha — SBOMs are now mandatory, not aspirational: US EO 14028 requires SBOMs for software sold to the federal government, and the EU Cyber Resilience Act requires them for digital products with enforcement ramping 2026–2027. Treat SBOM generation as a build step and signing as a pipeline gate, not a nice-to-have. Full detail in supply-chain-security.md.

Infrastructure

Terraform / OpenTofu — Terraform remains the most widely used IaC tool but moved to the BSL license in 2023 (and HashiCorp was acquired by IBM), which drove the OpenTofu fork under the Linux Foundation; OpenTofu is compatible with Terraform providers/state and is gaining enterprise adoption.
Docker — image building and local dev (BuildKit standard, multi-arch builds); containerd/CRI-O run production K8s; Podman as a rootless alternative.
Kubernetes — CNCF graduated, the de facto orchestration standard; managed services (EKS, GKE, AKS) dominate.
Ephemeral preview environments — per-PR environments (Vercel Previews, Railway, GitLab Review Apps, Harness CIE, and peers) are maturing into a standard practice: "every PR gets an environment," torn down on merge.

How to Choose: A Selection Framework

Start from your delivery model, not the tool catalog. Trunk-based + continuous deployment → managed CI + GitOps + progressive delivery. Scheduled/versioned software → release trains + a release-automation tool + a branch-cut ceremony.
Pick the CI your repo already lives in unless you have a concrete reason not to (GitHub → Actions; GitLab → GitLab CI; legacy/air-gapped → Jenkins).
Adopt OCI as the artifact lingua franca — it keeps registry, signing, and SBOM choices interoperable.
Buy progressive delivery and feature flags; build the release process. Flags, canary analysis, and registries are commodity capabilities; your differentiation is the governance, gates, and runbooks wrapped around them.
Optimize the bottleneck first: cache strategy and runner economics for CI cost; SBOM/signing coverage for compliance; rollback time for incident risk.
Revisit quarterly. The toolchain moves fast: Spinnaker declined, Earthly wound down, uv displaced Poetry, OpenTofu rose — a tool picked three years ago may now be a maintenance liability.

Gotcha — dead and dying tools: Do not recommend tools on momentum. Earthly's container-native CI business wound down in 2025 (Dagger runs an official migration program); Spinnaker is in organic decline; Notary is legacy; Poetry is being displaced by uv for new Python work. Check maintenance status before recommending anything in this list's "declining" column.

Trends

GitOps vs. push: GitOps (Argo CD, Flux) is winning for Kubernetes; push-based CD remains necessary for non-K8s targets. The two coexist; treat Git as the reconciliation source of truth where it fits.

Dimension	GitOps (Argo CD, Flux)	Push-based (Jenkins, CI pipelines, Harness)
Model	Git is the source of truth; controllers reconcile cluster state	Pipeline pushes artifacts/changes to targets
Strengths	Auditability, drift detection, self-healing, declarative	Simplicity for non-K8s targets; familiar mental model
Best for	Kubernetes-native workloads	VMs, serverless, multi-target, legacy
Trajectory	Winning for K8s; becoming the default	Still necessary for non-K8s; declining for K8s

Platform engineering convergence: Backstage (CNCF's #5 project by velocity) and internal developer platforms (IDPs from Harness, Humanitec, Port, Cortex) are absorbing CI/CD, IaC, observability, and service catalogs behind developer-facing abstractions — "deployment pipelines as product," with SLAs, docs, and support.
Ephemeral environments: per-PR preview environments are becoming a standard practice ("every PR gets an environment," torn down on merge), replacing the cost and drift of idle permanent staging.
AI-assisted pipelines: Copilot for workflow authoring, GitLab Duo for pipeline debugging, CircleCI ML test splitting, Harness AI deployment verification, and Dagger + LLM pipeline functions. Trajectory: from passive suggestions to active pipeline participation to autonomous remediation — see the tiered-autonomy model in release-operations-and-triage.md.

18 KiB Raw Blame History Unescape Escape