DevOps Automation Checklist for Agency & Consulting

Use GitHub Template Repos or GitLab Project Templates to scaffold CODEOWNERS, branch protection, CI workflows, and a Makefile. This enforces a predictable baseline per client and accelerates audits and onboarding.

Provision Okta or Azure AD groups mapped to per-client GitHub teams and cloud IAM roles managed via Terraform. Enforce least privilege and prevent accidental cross-client access by keeping identities and permissions isolated.

Integrate Vault, AWS Secrets Manager, or GCP Secret Manager namespaced by client and environment, fetched via OIDC in CI. Rotate credentials automatically and log access for audit trails required by enterprise clients.

Add a service.yaml that defines SLA tier, maintenance windows, RTO/RPO, and notification channels. Make CI read these values to schedule deploys and route alerts to the right client channels.

Require a Jira Service Management or Azure Boards change record validated by a CI check to deploy to prod. Only allow deploys when the change is approved and scheduled within the defined maintenance window.

Control steps like Lighthouse audits, OWASP ZAP scans, and content migrations via CI variables declared in a contract.json. This keeps scope visible and billable while ensuring consistent execution across clients.

Configure GitHub Actions or GitLab CI matrices for Node, Python, and PHP with dependency caching for pnpm, pip, or composer. Apply consistent test coverage thresholds and fail fast to reduce rebuild time and context switches.

Publish composite actions or GitLab includes for lint, test, build, and deploy steps versioned with semver. Allow per-client overrides via inputs, reducing duplication and easing updates across many projects.

Protect main and release branches with required status checks, peer review, and signed commits. This prevents rushed merges that later break client environments and impact SLAs.

Use Vercel or Netlify for frontends and ephemeral Kubernetes namespaces with Helm for services, with TTL auto-cleanup. Give account managers and clients a PR URL to approve changes without staging contention.

Require explicit approval for migrations and snapshot databases with pg_dump, mysqldump, or RDS snapshots before running. Include a tested rollback script to cut recovery time during incidents.

Use buildkit or language-specific caches plus artifact storage in GitHub Packages, Artifactory, or Nexus. Set retention per client SLA to reduce storage costs without losing traceability.

Separate Terraform or Pulumi stacks by client and environment with clear naming like client-prod-us-east-1. This isolates failure domains and makes state and change reviews manageable at scale.

Back state with Terraform Cloud or S3 plus DynamoDB locking, and scope access per client. This prevents concurrent applies and accidental cross-client resource changes.

Use Sentinel, OPA, or Conftest to block 0.0.0.0/0 rules, oversized instances, or untagged resources. Run policies in CI on every plan and require approval to override with justification.

Standardize VPCs, ECS/EKS clusters, GKE, or Cloud Run with internal Terraform modules or Pulumi packages. Version modules, document inputs, and enforce consuming them in new client stacks.

Manage per-environment secrets in YAML or JSON encrypted with SOPS and AWS KMS, GCP KMS, or age. Decrypt only during apply to keep secrets out of state and pull requests.

Use Argo Rollouts, AWS CodeDeploy, or LaunchDarkly feature flags to shift traffic progressively and auto-rollback on failed health checks. Make the strategy a parameter in the deployment job to fit client risk profiles.

Enable Dependabot or Renovate per repo with agency-wide rules to auto-merge patch versions and schedule major version PRs. This keeps client apps secure without manual backlog churn.

Run Snyk, Trivy, or Grype to fail builds on high severity vulnerabilities and produce reports for clients. Use allowlists sparingly with expiration dates to avoid permanent risk acceptance.

Create CycloneDX or SPDX SBOMs with Syft and attach them to release artifacts or a package registry. Share SBOMs with enterprise clients to meet procurement and compliance requirements.

Use Cosign with OIDC keyless signing and enforce verification in cluster admission policies via Kyverno or Gatekeeper. This prevents untrusted images from running in client environments.

Configure GitHub Actions or GitLab to assume AWS IAM or GCP Workload Identity roles without static keys. Rotate nothing, reduce breach risk, and trace who assumed what for each client.

Turn on GitHub secret scanning and Gitleaks pre-commit hooks, and wire detected leaks to auto-rotate via Vault or cloud APIs. This stops credential sprawl and shortens exposure windows.

Ship logs to ELK, OpenSearch, or Datadog using indices like client-service-env-date with role-based access. Set retention per SLA to balance cost and compliance.

Use Grafana provisioning or jsonnet to publish standardized panels for p95 latency, error rate, and dependency health. Commit dashboards alongside services so updates track releases.

Calculate burn rate SLOs in Prometheus and route alerts via Alertmanager to client specific PagerDuty services and Slack channels. Respect time zones, escalation chains, and severity policies.

Send release markers from CI to Datadog, New Relic, or Honeycomb with commit SHA and version. Correlate latency, errors, and throughput changes to deploys during triage.

Run k6, Checkly, or Playwright checks after deploys and fail the pipeline on regression thresholds. Capture HAR files, screenshots, and logs as artifacts for fast debugging.

Block production releases when SLO burn exceeds agreed budgets and require an override with client approval. This prevents SLA breaches caused by piling changes on unstable systems.

Store Markdown runbooks in each repo with shell snippets and links to dashboards, and expose commands via Slack bots. Include a quick path for rollback, cache flush, and feature flag toggles.

Create PagerDuty services per client with schedules that meet contractual response times and escalation policies. Share schedules with account managers so communication is clear during incidents.

Configure Argo Rollouts, AWS CodeDeploy, or Helm to auto revert when error rate or latency exceeds thresholds after deploy. Notify stakeholders and attach a diff of what was rolled back.

Use Statuspage, Freshstatus, or templates stored in the repo to send initial, update, and resolved notices. Pre approve language for P1, P2, and maintenance events to save time in crises.

Create Jira or Linear PIR tickets from PagerDuty with timelines, logs, and dashboards attached automatically. Set due dates and track action items to completion across teams.

Run quarterly failovers or restores using tools like Gremlin or Litmus and report pass or fail to clients. Measure recovery times against contracts and create remediation tasks when gaps appear.