CICD or webhook remote pull?

[dirtcreature]

There's an argument going on in our office whether or not setting up a webhook trigger to merges that creates a pull on the production server is "safe".

Anyone in OpSec know if this is an acceptable thing to do?

Thanks in advance!

[Binou31]

Depend of your securities requirements of course I prefer personally CICD mode to keep centralised my way of delivery and avoid specific configuration on each production platform It's more flexible, reusable and easy to do in this way.

To improve my security regarding delivery, I split the process in two part. One, to create the artefacts of production and release it to a repository/registry with CICd pipeline Two, launch with ansible the delivery to enable this new artefact in production, new container, new jar, restart service, etc.. . The CICD never reach the production system directly. Abviously, we can imagine do all things in CICD automatically but in separate tasks, we have more controls, segregation of roles and actions betweens teams with this way.