Last Friday, around 3pm, I discovered that the code I was working on for a client had the potential to allow SQL injection attacks. The fix wasn’t difficult, and after about half an hour I had a PR ready to be merged.

The question then became: Do we merge and deploy now, right before end-of-day on a Friday? Or wait until Monday at the next planned release?

We discussed for a while, and the details don’t really matter.

What does matter is that we decided to go ahead with the deployment on Friday. But to wait until after 5pm, so that the 2-minutes of downtime that come with each release, wouldn’t happen during business hours.

So the team lead deployed the software, then said:

Deployment is complete. I gotta run. I hope nothing breaks. See you next week.

Scary? Perhaps.

But the clincher is what happened next. The CTO said:

It’s pretty amazing that you can deploy on a Friday at 5pm, then take off immediately. That wasn’t even thinkable a month ago.

A month before, deployments were happing at 3am, and involved a bunch of post-hoc manual testing.

Can you deploy a security patch at 5pm on a Friday, then take the weekend off?

If not, what’s standing in your way? What steps can you take to improve the situation?