> **Page index:** https://km.oslo.systems/llms.txt lists every page on this site, with a link to its Markdown version.

# Set up CI/CD for `prod`

Extend an existing dev-only CI/CD workflow so your application also deploys to production, with manual approval.

## Before you begin

You have completed [Set up CI/CD for `dev`](<https://km.oslo.systems/application/container/set-up-cicd-for-dev/index.md>), which sets up an app repository and a CI/CD workflow for your `dev` environment.

## Step 1: Replace `.gp.cicd.json` with the full template

[Set up CI/CD for `dev`](<https://km.oslo.systems/application/container/set-up-cicd-for-dev/index.md>) installed the dev-only `.gp.cicd.json` template. Replace it with the full template, which adds the production section:

hello-world/

```
gh api repos/oslokommune/golden-path-templates/contents/templates/gh-cicd-app/.gp.cicd.json \
  --jq '.content' | base64 -d > .gp.cicd.json
```

Re-apply the `dev` values you set during app repository setup, and fill in the production values. You can find them in `common-config.yml` in your IaC repository's `prod` environment directory.

| Field | Description | Example |
| --- | --- | --- |
| `<team-name>` | Your team name | `pirates` |
| `<repo-iac>` | Infrastructure-as-code repository name | `pirates-iac` |
| `<dev-aws-account-id>` | AWS account ID for `dev` | `123456789012` |
| `<dev-environment-name>` | Name of your `dev` AWS environment | `pirates-dev` |
| `<prod-aws-account-id>` | AWS account ID for `prod` | `987654321098` |
| `<prod-environment-name>` | Name of your `prod` AWS environment | `pirates-prod` |
| `<dev-iac-directory>` | The directory containing IaC for your `dev` environment | `stacks/dev` |
| `<prod-iac-directory>` | The directory containing IaC for your `prod` environment | `stacks/prod` |
| `<aws-region>` | Your AWS region | `eu-west-1` |

## Step 2: Protect GitHub Actions environment targeting production

This enables manual approval for deployments to production, and ensures that deployments to production only can be made from the default branch. This should **only** be set up for production, not for other environments.

> [!NOTE]
>
> **Manual approval**
>
> You can turn off manual approval of production deployments if you want to, but we **strongly recommend** that you enable it during initial setup to reduce the risk of negatively affecting your production environment.

1. Go to **Settings \> Environments \> New environment**
2. Set the name to match the name of your production environment:

   - For an application repository: `<environment>` (for example, `pirates-prod`)
   - For an application monorepo: `<environment>-<app-name>` (for example, `pirates-prod-swordsmith`)
3. Set **Required reviewers** to your GitHub team
4. Click **Save protection rules**
5. Under **Deployment branches and tags**, select **Selected branches** and add your default branch (`main` or `master`)

## Step 3: Enable production deployment in the workflow

Uncomment the production deployment job that you commented out in [Step 3.2 of Set up CI/CD for `dev`](<https://km.oslo.systems/application/container/set-up-cicd-for-dev/#step-32-disable-production-deployment>).

## Step 4: Create a pull request

Push the branch and create a pull request.

Verify that the build job succeeds and that no deployment occurs.

## Step 5: Merge and deploy

Merge the pull request.

## Verify

Commit a change to your application and verify that the pipeline:

- deploys to `dev` first, then production
- asks for your confirmation before deploying to production (if you enabled environment protection).