A three-person team can ship five times a day with the right CI/CD pipeline. Big-company DevOps processes (SAST gates, multi-stage approvals) actually slow small teams down. Here's what we recommend after setting up pipelines for 40+ startups.
The minimal pipeline (30 minutes to set up)
- GitHub Actions (or GitLab CI) — free for public repos, cheap for private.
- Lint + test on every push — ESLint/PHPStan + your test suite, in parallel.
- Build once, deploy everywhere — build a Docker image tagged by commit SHA; use the same image for staging and production.
- Deploy to staging automatically on merge to
main. - Deploy to production on tag or button click — one-click rollback is critical.
Five rules we never break
- Never deploy on Friday afternoon unless you want to work Saturday. Counterintuitive but statistically true in our client data.
- Migrations must be reversible. Add columns with defaults, backfill, then remove old columns in a separate release.
- Health checks before traffic. New deployments must pass a
/healthendpoint before receiving traffic. - Log every deploy. Timestamp, commit SHA, deployer, and rollback version — in one place.
- Rollback in under 60 seconds. If it takes longer, your pipeline is broken.
What changes at 10+ engineers
The above is enough until ~10 engineers. Then you need: SAST in the pipeline, dedicated staging and QA environments, feature flags, canary deployments, and a proper on-call rotation. Don't build any of that prematurely — it's the classic over-engineering trap.
