Workflows that run real business processes are production software, yet they are often changed the least safely of anything in the stack — edited directly in a live UI, with no test, no review, and no rollback. Applying CI/CD to workflows closes that gap: changes are versioned, validated, tested, and promoted through environments the same way your services are.
Definitions in version control
CI/CD starts with the workflow definition as code in a repository — the foundation everything else builds on. Export the workflow to JSON or YAML, commit it, and make the repo the source of truth. Without this, there is nothing for a pipeline to act on; with it, every subsequent stage becomes possible.
Validate, test, promote
On each change, the pipeline runs the same gates you would want for any deploy:
- Validate — lint the definition; catch structural errors, missing credentials references, and broken step links before anything runs.
- Test — run step-level and mocked tests, and an end-to-end pass against a sandbox environment.
- Promote — deploy the exact reviewed definition to staging, verify, then to production; the same artifact moves through each stage.
on: pull_request
jobs:
validate:
steps:
- run: workflow lint workflows/*.json # structural checks
- run: pytest tests/workflows # step + mocked tests
- run: workflow test --env sandbox order-sync # end-to-end
deploy:
if: github.ref == 'refs/heads/main'
steps:
- run: workflow import --env staging workflows/order-sync.json
- run: workflow import --env production workflows/order-sync.jsonMake deploys reversible
The pipeline must be able to go backwards. Because the previous definition is a prior commit, a rollback is redeploying that commit — automated, fast, and certain. Design the promotion step so re-importing an older version is a first-class operation, not a manual scramble. A deploy you cannot reverse is a deploy you will be afraid to make.
Workflow definitions reference credentials; they must never contain them. Keep secrets in the platform's credential store or a secret manager, referenced by name, so the same definition promotes cleanly across environments and a committed file never leaks a key. Environment-specific config lives outside the versioned definition.
CI/CD for workflows is version-controlled definitions, a pipeline that validates and tests before it promotes, the same artifact moving through environments, and reversible deploys. It replaces "edit in production and watch" with a delivery process that makes changing critical automation routine instead of risky.
Independent software engineer in Nairobi specialising in Acumatica customisations, Laravel backends, and tax fiscalisation integrations across East and Southern Africa.