Establish and Document the Application's Configuration and Build Rules

This chapter explains how to establish and document the rules by which an Application is configured and built. The rules that govern how configuration is managed over time, such as who may change it and how it is promoted between environments, are addressed in the chapter “Establish and Document the Application’s Configuration Rules.”

Definitions

Build is the process of transforming an Application’s source code, configuration, and dependencies into executable or deployable artifacts, using defined tools and Build rules.

The Scope of Build

Build applies to whatever the enterprise builds, assembles, extends, configures, or integrates within the Application Boundary, whatever the Application’s Sourcing Type. Where a vendor fully controls a part of the Application, the enterprise documents the vendor’s Releases and its own configuration of that part.

Establish the Configuration and Build Rules

Establish, with the IT Application Owner and the Development or Engineering Organization:

• Build prerequisites: the tools, versions, and environment required to build the Application.

• Build steps: the exact sequence for producing the Application’s artifacts from its repositories, including dependency resolution, compilation, code generation, and assembly.

• Build-time configuration: the settings, flags, and parameters applied during Build, and how they differ by target environment or Instance.

• Quality and security checks: the code analysis, security scanning, and automated tests that every Build must pass.

• Versioning rules: how each Build is identified, so that every artifact can be traced back to its exact source.

• Reproducibility: how to ensure the same source always produces the same artifacts.

Document and Share the Configuration and Build Rules

Record the configuration and Build rules in the Build, Packaging, and Configuration section of the Application Documentation, and keep the Build scripts and definitions themselves in the Application’s repositories, linked from the documentation. Record Build differences between Instances explicitly. Update the rules with every Release that changes them.

Best Practice: Establish and Document the Application’s Configuration and Build Rules

It is a best practice to both establish and document the solution for how an Application is built: define its Build prerequisites, steps, configuration, required checks, versioning, and reproducibility, and record them alongside the Build definitions themselves.

Benefits: Documented Build rules mean that anyone authorized, not only the original developers, can rebuild the Application, which is essential when fixing Production urgently or recovering from the loss of a team member. Traceable, reproducible Builds also let the enterprise prove exactly what was built from what, which matters for security and audit.

Connections to Related IF4IT Practices and Inventories

The Systems Development Lifecycle (SDLC) Best Practices describes the Implementation and Build phase. The configurations and rules covered here are also addressed by the baseline framework described in the chapter “Understand the IF4IT Baseline Framework for Application Configurations, Dependencies, and Rules.”