The rule exists for a good reason: a bad Friday deploy ruins a weekend. But the rule treats the day as the risk, and the day is not the risk — the deploy is. A pipeline that is dangerous on Friday afternoon was already dangerous on Tuesday morning; Friday just moves the discovery to a worse time.
The four properties#
- 01Rollback in under two minutes
Not “redeploy the previous commit and wait for CI” — a promotion of the previous build, one action, no build step. If rolling back takes as long as fixing forward, you do not have a rollback, you have a second deploy.
- 02Behind a flag
Anything user-visible ships dark and gets turned on separately. That decouples “the code is out” from “the change is live”, and it means the fix for a bad change is a toggle rather than a release.
- 03Backwards-compatible migrations
Add columns, backfill, then read. Never a migration whose rollback is a restore from backup — that is the one class of change we genuinely do not ship on a Friday.
- 04Somebody actually available
Named, not assumed, and with a laptop that is charged. The person who deployed stays reachable for two hours. Usually it is the most boring two hours of the week.
Why we bother#
Because the alternative is worse. A Friday freeze means Monday carries two days of work, so Monday's deploy is bigger, and a bigger deploy is a riskier deploy with more places for a fault to hide. Batching changes to avoid risk mostly concentrates it.
It also does something quieter: making Friday safe forces the pipeline to be good. Every one of the four properties above exists because we wanted to ship on a Friday and found we could not do it honestly. The freeze would have let all four stay broken indefinitely.