DELIVERY ARCHITECTURE COMMAND
P100 OVERVIEW --:--:-- CONNECTING
LIVE

OVERVIEW • DOCUMENTATION • GITHUB • GITHUB ACTIONS • HELM • ARGO CD • BUILD • TEST • DEPLOY • RELEASE • ROLLBACK • SECURITY SCAN • D1 LOCAL SNAPSHOT BRIDGE • REPOSITORY MESH •

P100 / ENTERPRISE DELIVERY CONTROL PLANE

DEVOPS
PLATFORM

A complete architecture for source control, CI, security gates, Helm packaging, Argo CD reconciliation, production verification, release governance and rollback. Argo CD remains private and reports through a domain-free D1 snapshot bridge.

Workflow runs—GitHub API
Success rate—completed runs
GitOps apps—D1 snapshot
Healthy targets—edge probes
architecture.runtimeBOOTING
COMMIT→PRODUCTION
CONTROLGitHubActions Runner
ASSURANCEBuild + TestSecurity Scan
DELIVERYHelm ChartArgo CD
OPERATIONSReleaseRollback
> load delivery.graph> mount d1.snapshot.bridge> enable policy.gates> system ready_

P110 / COMPLETE SYSTEM MAP

One platform. Twelve operational surfaces.

Every module is independently documented yet connected to one auditable delivery graph.

DELIVERY GRAPH / HORIZONTAL AXISDrag, swipe, use Shift + wheel, or the controls.
01 / 06
01 / SOURCE

GitHub

Code, pull requests, tags, releases and protected environments.

SOURCE CONTROL ↗
→
02 / AUTOMATE

GitHub Actions

Hosted or self-hosted runner executes the delivery contract.

ACTIONS/RUNNER ↗
→
03 / ASSURE

Build · Test · Scan

Artifact creation, verification, SBOM and vulnerability gates.

AQUASECURITY/TRIVY ↗
→
04 / PACKAGE

Helm

Versioned Kubernetes release with resilience resources.

HELM/HELM ↗
→
05 / RECONCILE

Argo CD

Declarative desired state, drift detection and health reporting.

ARGOPROJ/ARGO-CD ↗
→
06 / OPERATE

Deploy · Release · Rollback

Controlled promotion, verification and recovery.

PROMETHEUS ↗
VERTICAL SCROLL CONTINUES THE COMMAND SURFACEHORIZONTAL OVERFLOW CONTAINED INSIDE THIS RAIL

P120 / REPOSITORY MESH

Upstream systems connected to the delivery graph.

Official repositories are grouped by execution, packaging, reconciliation, security, observability and edge runtime. Hovering a node also drives the polymorph background.

EXECUTIONactions/runnerWorkflow job runtime01 ↗ PACKAGINGhelm/helmKubernetes package manager02 ↗ GITOPSargoproj/argo-cdDeclarative reconciliation03 ↗ ORCHESTRATIONkubernetes/kubernetesCluster control plane04 ↗ SECURITYaquasecurity/trivyVulnerability + IaC scanning05 ↗ SUPPLY CHAINsigstore/cosignArtifact signing + verification06 ↗ METRICSprometheus/prometheusTime-series monitoring07 ↗ OBSERVABILITYgrafana/grafanaDashboards + alerting08 ↗ EDGE RUNTIMEcloudflare/workers-sdkWrangler + Workers tooling09 ↗ DESIGN REFERENCEnotoriousb1t/polymorphSVG path morphing reference10 ↗
P200

Documentation

Architecture, deployment, security, rollback, Helm and domain-free Argo CD runbooks.

01

Architecture

System boundaries, data flow and operational responsibilities.

OPEN ↗ 02

Cloudflare Deployment

Pages Advanced Mode, variables, secrets and D1 binding.

OPEN ↗ 03

No-domain Argo CD

Push a sanitized local cluster snapshot to D1 without public ingress.

OPEN ↗ 04

Security Pipeline

Least privilege, scanning and production approval controls.

OPEN ↗ 05

Helm Release

Lint, render, package, publish and promote the chart.

OPEN ↗ 06

Rollback Runbook

Restore a known-good revision and verify service health.

OPEN ↗ 07

Variables Required

Exact Cloudflare and GitHub configuration contract.

OPEN ↗ 08

Source Manifest

Checksum-indexed upstream source archive metadata.

OPEN ↗

P220 / SOURCE VAULT

Reconstructible upstream source.

The package preserves source manifests, licenses and split archives for GitHub Actions Runner, Helm and Argo CD.

Loading manifest…
P300

GitHub

Repository identity, live workflow metadata, releases, webhooks and source-of-truth governance.

CONNECTED REPOSITORY

Not configured

Configure GITHUB_OWNER, GITHUB_REPO and a fine-grained GITHUB_TOKEN in Cloudflare Pages.

Open GitHub ↗Configuration
Latest conclusion—
Average duration—
Last update—
Connection—
RunWorkflowBranchEventStatusDurationUpdated
Waiting for GitHub configuration.
CI/CD workflowRelease workflow
P310

GitHub Actions

The runner executes build, test, scan, package, promotion and verification as one enforceable delivery contract.

OFFICIAL UPSTREAM

actions/runner

The runner application executes GitHub Actions jobs in hosted or self-hosted environments.

GitHub repository ↗
01CHECKOUT

Resolve commit and dependencies.

02BUILD

Create immutable application artifact.

03TEST

Unit, integration and smoke verification.

04SCAN

Code, dependencies, image and SBOM.

05HELM

Lint, render and package release.

06GITOPS

Update desired-state revision.

07VERIFY

Observe health and rollback guard.

WORKFLOW CONTRACTYAML
pull_request → quality + security
main         → image + chart + GitOps
tag v*       → release + provenance
manual       → deploy / rollback
Open production workflow ↗
MANUAL DISPATCHADMIN

Dispatch is protected by DEVOPS_ADMIN_TOKEN. The token is used once in memory and never stored by this page.

Idle
P400

Helm

A production chart packages workload, network, scaling, disruption, policy and observability resources.

OFFICIAL UPSTREAM

helm/helm

Kubernetes package management with versioned, reusable and configurable charts.

GitHub repository ↗
Chart.yaml
values.yaml
templates/deployment.yaml
templates/service.yaml
templates/ingress.yaml
templates/hpa.yaml
templates/pdb.yaml
templates/networkpolicy.yaml
templates/servicemonitor.yaml
templates/prometheusrule.yaml
RELEASE ENGINESEMVER
  1. Linthelm lint
  2. Renderhelm template
  3. Packagehelm package
  4. PublishOCI registry
  5. PromoteGitOps values update
Chart.yamlvalues.yaml
P500

Argo CD

Declarative Kubernetes delivery with a private local control plane and a domain-free D1 snapshot bridge.

OFFICIAL UPSTREAM

argoproj/argo-cd

Continuous delivery and GitOps reconciliation for Kubernetes applications.

GitHub repository ↗
LOCALDocker Desktop Kubernetes
→
READkubectl Argo Applications
→
PUSHPowerShell Snapshot Bridge
→
STORECloudflare D1
→
DISPLAYPages Dashboard
Mode—
Snapshot updated—
Applications—
Healthy / Synced—
ApplicationProjectSyncHealthRevisionDestination
No Argo CD snapshot yet. Run the included PowerShell bridge.
Snapshot bridgeNo-domain guide
P600

Build

Produce deterministic, immutable and traceable artifacts before deployment.

01

Resolve

Pin dependencies and validate lockfiles.

npm ci
02

Compile

Generate deployable static and container assets.

npm run build
03

Containerize

Build a minimal runtime image from the included Dockerfile.

docker build
04

Identify

Tag every artifact with commit SHA and semantic version.

sha256 + semver

BUILD OUTPUT

One commit → one immutable identity.

STATIC Cloudflare Pages artifactIMAGE OCI container imageCHART Helm packageSBOM Software bill of materialsPROVENANCE Build attestation
P700

Test

Layered verification catches regressions before promotion.

UNITFunctions and modules

Fast deterministic checks for individual behavior.

INTEGRATIONWorker + D1 + APIs

Validate boundaries and data contracts.

RENDERHelm template

Confirm valid Kubernetes resources before sync.

SMOKEApplication health

Probe the deployed service after reconciliation.

CONTRACTRequired variables

Fail early when configuration is incomplete.

RESILIENCERollback verification

Ensure the prior release can be restored safely.

LOCAL VALIDATIONNODE TEST
npm run lint
npm test
npm run build
helm lint blueprints/helm/devops-platform
helm template devops-platform blueprints/helm/devops-platform
P800

Deploy

Promotion changes desired state; Argo CD performs the deployment and health reconciliation.

01Artifact published

Image and chart are immutable and signed.

02GitOps updated

Workflow changes the image tag or chart version.

03Argo CD detects drift

Desired revision differs from the live cluster.

04Sync and health

Resources reconcile with prune and self-heal policies.

05Production verification

Health endpoints and operational signals are checked.

Application—waiting
Metrics—waiting
Argo CD—waiting
Delivery modelGITOPSdeclarative promotion
P900

Release

Version, provenance and changelog turn a successful build into an auditable product release.

RELEASE CONTRACTTAG v*
  1. VersionSemantic tag
  2. PackageChart + image
  3. AttestSBOM + provenance
  4. PublishGitHub release
  5. PromoteProduction GitOps
Open release workflow ↗
LATEST RELEASESGITHUB

Loading releases…

P910

Rollback

Recovery is a controlled Git operation followed by Argo CD reconciliation and health verification.

01

Select known-good revision

Use a previously verified image or chart version.

→
02

Update desired state

Commit the rollback to the GitOps repository.

→
03

Argo CD reconciles

Sync the previous version and remove unsafe drift.

→
04

Verify recovery

Check application health, metrics and event history.

RECOVERY RULESSAFE
  • Never mutate a live deployment manually.
  • Rollback through version-controlled desired state.
  • Record the operator, reason and revision.
  • Verify health before closing the incident.
  • Follow with root-cause remediation.
Open runbook ↗
P920

Security Scan

Security is a required delivery gate, not a post-deployment report.

SAST

Source analysis

Detect unsafe patterns and vulnerable code paths.

CODEQL
SCA

Dependency review

Audit packages, licenses and known CVEs.

DEPENDABOT
IMAGE

Container scan

Block critical vulnerabilities before publishing.

TRIVY
SUPPLY CHAIN

SBOM + provenance

Trace exactly what entered every release artifact.

SPDX / SLSA
SECRETS

Credential detection

Prevent keys and tokens from entering source history.

SECRET SCAN
POLICY

Deployment controls

Least privilege, protected environments and approvals.

RBAC

P929 / REQUIRED GATE

No critical finding reaches production.

  • Workflow permissions default to read-only.
  • External actions are pinned to trusted versions.
  • Production uses explicit environment approval.
  • GitOps and Argo CD accounts receive minimum permissions.
  • Secrets stay in GitHub or Cloudflare encrypted stores.
Security policy ↗