Quality without bureaucracy: how not to break what works
Small and frequent
A release of a hundred changes once a month turns every incident into an investigation. A release of one change a day turns it into a clear suspect. Batch size is the variable that matters more than any process.
Automated gates
Tests, type checks, static analysis and a security scan — all run on their own and block on their own. An automated rule isn't personal and doesn't invite an argument.
What's left for a person: questions a tool can't answer.
Recover fast
Invest more in the time to return to normal than in trying to prevent every incident. A system you can roll back in two minutes lets the team move fast with confidence; a system where every release is frightening produces bigger, riskier releases.
Going deeper
Track four metrics: release frequency, time from change to production, the share of releases that caused an incident, and recovery time. They measure the system and the process together, and are hard to fake.