Automate the Application's Build and Packaging

This chapter explains why an Application’s Build and Packaging should be automated, and how automation relates to documentation.

Why Automate Build and Packaging

Manual Builds are slow, error-prone, and dependent on the individuals who know how to perform them, and two people following the same written procedure can still produce different results. Automated Build and Packaging, typically triggered whenever code changes, produces the same result every time, enforces the required quality and security checks without exception, and frees people from repetitive work.

Automation also strengthens documentation. An automated Build definition is itself a precise, executable description of how the Application is built. The documentation can then describe the pipeline’s purpose, stages, and controls, and link to the definition, rather than trying to describe every step in prose.

Establish Build and Packaging Automation

Automate, to the greatest degree feasible:

• Building the Application from its repositories whenever changes are made.

• Running the required code analysis, security scans, and automated tests.

• Packaging the results, generating the Software Bill of Materials, and storing versioned packages in the artifact repository.

• Recording the results of each Build, so that failures are visible and traceable.

Where the Build and Packaging automation is owned by another team, such as a shared engineering platform team, document that dependency explicitly, since the Application’s speed, quality, and recovery depend on it.

Document and Share the Automation

Record the automation’s stages, triggers, required checks, and owners in the Application Documentation, and link to the automation definitions in the Application’s repositories. Record any steps that remain manual, with the reason and the procedure.

Best Practice: Automate the Application’s Build and Packaging

It is a best practice to both establish and document the solution for producing an Application’s packages: automate Build, checks, Packaging, and SBOM generation to the greatest degree feasible, document the automation and its owners, and record any remaining manual steps with their justification.

Benefits: Automated Build and Packaging delivers faster, more consistent, and more secure Releases, because every Build follows the same steps and passes the same checks. It also makes the Application far less dependent on individual knowledge, since the automation itself preserves how the Application is built.

Advance Maturity Deliberately: Crawl, Walk, Run

• Crawl. Builds follow a documented, repeatable script that anyone authorized can run.

• Walk. Builds and Packaging run automatically on every change, with required checks enforced and results recorded.

• Run. The full path from code change to signed, versioned package with an SBOM is automated, and Build and Packaging metrics are used to improve speed and quality.

Connections to Related IF4IT Practices and Inventories

The IT Operating Environments Best Practices addresses encoding governance policies, security controls, and compliance checks within automated pipelines. The Release Management Best Practices addresses the Release content that automated pipelines produce.