emergency-release-workflow

紧急发布工作流技能

摘要

针对需要立即部署的严重生产问题的快速处理工作流。涵盖紧急程度评估、加速 PR 流程、部署验证和事后分析。

适用场景

• 影响用户的严重生产环境 Bug
• 安全漏洞（CVE）
• 紧急业务需求
• 数据完整性问题
• 服务中断
• 支付处理故障

紧急程度评估

优先级别

级别	类型	响应时间	部署	示例
P0	安全漏洞	< 2 小时	立即部署到生产环境	身份验证绕过、数据泄露、正在被利用的漏洞
P1	生产环境宕机	< 4 小时	当天	应用崩溃、功能完全失效、支付服务中断
P2	重大 Bug	< 24 小时	下一个工作日	关键功能故障、对用户造成重大影响
P3	业务关键问题	< 48 小时	按计划发布	阻碍营销活动、合作伙伴截止期限

P0 标准（立即处理）

• 绕过身份验证／授权
• 数据泄露或暴露
• 远程代码执行漏洞
• 生产服务完全不可用
• 影响多位用户的数据损坏
• 支付处理完全故障

P1 标准（当天处理）

• 关键功能完全故障
• 影响大多数用户的错误
• 影响收入的 Bug
• 数据库连接问题
• 第三方集成故障（关键服务）

P2 标准（下一个工作日处理）

• 重大功能部分故障
• 影响特定用户群体
• 有可用的变通方案，但不理想
• 性能下降（非完全故障）

---

紧急发布流程

1. 创建 Hotfix 分支

# Branch from current production (main)
git checkout main
git pull origin main

# Create hotfix branch
git checkout -b hotfix/ENG-XXX-brief-description

# Example:
git checkout -b hotfix/ENG-1234-fix-auth-bypass

2. 实施最小修复

⚠️ CRITICAL: Minimal change only

DO:
✅ Fix the immediate issue
✅ Add regression test
✅ Document root cause in comments

DON'T:
❌ Refactor surrounding code
❌ Fix unrelated issues
❌ Add new features
❌ Update dependencies (unless that's the fix)

3. 彻底测试

# Run full test suite
pnpm test

# Type check
pnpm tsc --noEmit

# Build verification
pnpm build

# Manual testing checklist:
# - [ ] Reproduce original issue
# - [ ] Verify fix resolves issue
# - [ ] Test happy path
# - [ ] Test edge cases
# - [ ] Verify no new issues introduced

4. 添加标签并创建 PR

git add .
git commit -m "fix: [brief description of fix]

Fixes critical issue where [description].
Root cause: [explanation].

Ticket: ENG-XXX
Priority: P0"

git push origin hotfix/ENG-XXX-brief-description

在 PR 标题中使用清晰的标签：

• [RELEASE] - 直接发布到生产环境
• [HOTFIX] - 严重修复，加速审核
• [P0] 或 [P1] - 优先级标识

---

Hotfix PR 模板

Hotfix PR 模板

## 🚨 [RELEASE] ENG-XXX: Brief description of fix

### Urgency
- [x] P0 - Security vulnerability
- [ ] P1 - Production down
- [ ] P2 - Major bug
- [ ] P3 - Business critical

### Impact
**Users affected**: [All users / Premium tier / Specific region / etc.]

**Severity**: [Choose one]
- [ ] Service completely unavailable
- [ ] Critical feature broken
- [ ] Security vulnerability
- [ ] Data integrity issue
- [ ] Degraded performance

**User impact**:
Describe how this affects end users.

### Root Cause
[Brief explanation of what caused the issue]

**How it happened:**
1. [Step 1]
2. [Step 2]
3. [Result: issue manifested]

**Why it wasn't caught:**
- [ ] Missing test coverage
- [ ] Race condition in production
- [ ] External service behavior changed
- [ ] Recent deployment introduced regression
- [ ] Other: [explain]

### The Fix
[What this PR changes to resolve the issue]

**Changes made:**
- Modified `file.ts` to [specific change]
- Added validation for [specific case]
- Fixed logic in [specific function]

**Why this fixes it:**
[Explanation of how the change resolves the root cause]

### Testing
- [ ] ✅ Reproduced issue locally
- [ ] ✅ Verified fix resolves issue
- [ ] ✅ Regression test added
- [ ] ✅ No other functionality affected
- [ ] ✅ Tested edge cases
- [ ] ✅ Deployed to staging and verified

### Regression Test
```typescript
// Test added to prevent recurrence
describe('ENG-XXX: Auth bypass fix', () => {
  it('should reject expired tokens', async () => {
    const expiredToken = generateExpiredToken();
    const response = await fetch('/api/protected', {
      headers: { Authorization: `Bearer ${expiredToken}` }
    });
    expect(response.status).toBe(401);
  });
});

回滚计划

如果此次变更导致问题：

# Option 1: Revert commit
git revert <commit-hash>
git push origin main

# Option 2: Deploy previous version
vercel rollback  # or your platform's rollback command

# Option 3: Feature flag
Set FEATURE_FIX_XXX=false in environment

监控：

• Sentry 中的错误率
• 监控仪表板中的 API 响应时间
• 支持渠道中的用户反馈

部署检查清单

• 至少一位审核者批准 PR（必要时可对 P0 豁免）
• 所有 CI 检查均已通过
• 已部署到预发布环境并完成验证
• 已配置监控告警
• 已通知值班工程师
• 已准备好部署到生产环境

部署后验证

部署后立即执行：

• 在生产环境中验证修复（直接测试端点）
• 检查错误跟踪（Sentry 等）
• 监控是否出现新错误
• 确认用户反馈不再出现

需要关注的指标：

• 错误率（应下降）
• API 延迟（应保持稳定）
• 用户活动（应恢复正常）

后续跟进

• 在 Linear 工单中更新解决方案
• 安排事后复盘（适用于 P0/P1）
• 为适当的修复创建工单（如果此次修复只是权宜之计）
• 更新操作手册／文档

---

## Deployment Steps

### Pre-Deployment
```bash
# 1. Merge PR to main
# (After approval or P0 emergency waiver)

# 2. Pull latest
git checkout main
git pull origin main

# 3. Verify commit
git log -1
# Confirm this is your hotfix commit

# 4. Tag release (if using semantic versioning)
git tag -a v2.3.5 -m "Hotfix: Fix auth bypass vulnerability"
git push origin v2.3.5

部署（特定平台）

Vercel

# Trigger production deployment
vercel --prod

# Or use Vercel dashboard:
# Deployments → Select commit → Deploy to Production

# Monitor deployment
vercel logs --follow

Netlify

# Deploy via CLI
netlify deploy --prod

# Or trigger from dashboard:
# Deploys → Select commit → Publish deploy

Railway

# Push to main triggers deployment automatically
# Monitor in dashboard: railway.app/project/logs

AWS/GCP/Azure

# Follow platform-specific deployment process
# Example for AWS Elastic Beanstalk:
eb deploy production --staged

# Monitor:
eb logs --follow

部署后验证

1. 冒烟测试

# Test the specific fix
curl -X POST https://api.production.com/auth/login \
  -H "Content-Type: application/json" \
  -d '{"token": "expired_token"}'

# Expected: 401 Unauthorized

2. 监控错误跟踪

✅ Check Sentry/Rollbar/etc.:
- Error rate should drop
- No new errors introduced

⏱️ Monitor for 15-30 minutes after deployment

3. 验证指标

Check monitoring dashboard:
- API response times (should be normal)
- Error rates (should drop)
- Database performance (should be stable)
- Third-party service health

4. 检查用户反馈

Monitor support channels:
- Support tickets
- In-app chat
- Social media
- Status page comments

---

沟通

内部沟通

Slack/Teams 消息模板

🚨 **Production Hotfix Deployed**

**Issue**: [Brief description]
**Ticket**: ENG-XXX
**Priority**: P0
**Status**: ✅ Resolved

**Timeline:**
- Issue discovered: 14:23 UTC
- Fix deployed: 15:47 UTC
- Duration: 1h 24m

**Impact**:
[Who was affected and how]

**Root Cause**:
[Brief explanation]

**Fix**:
[What was changed]

**Verification**:
✅ Error rate dropped from 450/min to 0/min
✅ All systems operating normally

**PR**: https://github.com/org/repo/pull/XXX

**Follow-up**:
- [ ] Post-incident review scheduled for [date]
- [ ] Documentation updated

外部沟通（如有需要）

状态页面更新

🟢 Resolved - [Issue Title]

We've resolved an issue that was affecting [feature/service].

**What happened:**
Between 14:23 and 15:47 UTC, users experienced [specific issue].

**Current status:**
The issue has been fully resolved. All systems are operating normally.

**Next steps:**
We're conducting a thorough review to prevent similar issues in the future.

We apologize for any inconvenience.

致受影响用户的邮件（针对严重问题）

Subject: Update on [Service] Issue - Resolved

Hi [User],

We're writing to update you on an issue that affected [feature/service] earlier today.

**What happened:**
Between [time] and [time], you may have experienced [specific issue].

**Resolution:**
Our team quickly identified and resolved the root cause. The service is now operating normally.

**What we're doing:**
We take these issues seriously and are:
- Conducting a full review of the incident
- Implementing additional safeguards
- Improving our monitoring

We apologize for any inconvenience this may have caused.

If you have any questions or concerns, please reach out to [email protected].

Thank you for your patience.

The [Company] Team

---

事后处理

立即采取的措施（24 小时内）

• 在 Linear 工单中更新完整的解决方案详情
• 将事件添加到事件日志／电子表格
• 记录事件时间线
• 确定哪些指标本应更早触发告警
• 为适当的修复创建后续工单（如果 Hotfix 是临时方案）

事后复盘（PIR）- 适用于 P0/P1

在 72 小时内安排

PIR 模板

# Post-Incident Review: [ENG-XXX]
Date: YYYY-MM-DD
Severity: P0/P1
Duration: Xh Xm

## Summary
Brief description of the incident.

## Timeline (UTC)
- 14:23 - Issue first detected
- 14:25 - On-call engineer alerted
- 14:30 - Root cause identified
- 14:45 - Fix PR opened
- 15:20 - PR approved and merged
- 15:47 - Fix deployed to production
- 16:00 - Verified resolved

## Impact
- **Users affected**: ~5,000 users
- **Duration**: 1h 24m
- **User experience**: Unable to log in
- **Revenue impact**: Estimated $X in lost transactions
- **Reputation impact**: 23 support tickets, 5 social media mentions

## Root Cause
Detailed technical explanation of what caused the issue.

[Include code snippets, sequence diagrams if helpful]

## Resolution
What was changed to fix the issue.

## What Went Well
- ✅ Fast detection (2 minutes after deploy)
- ✅ Clear reproduction steps identified quickly
- ✅ Team collaborated effectively
- ✅ Fix deployed in under 90 minutes

## What Went Wrong
- ❌ Missing test coverage for expired token edge case
- ❌ Staging didn't catch the issue (different token expiry settings)
- ❌ No automatic rollback triggered
- ❌ Monitoring alert threshold too high

## Action Items
- [ ] ENG-XXX-1: Add test for expired token validation (@engineer, by YYYY-MM-DD)
- [ ] ENG-XXX-2: Align staging token expiry with production (@devops, by YYYY-MM-DD)
- [ ] ENG-XXX-3: Implement automatic rollback on error spike (@platform, by YYYY-MM-DD)
- [ ] ENG-XXX-4: Lower monitoring alert threshold (@observability, by YYYY-MM-DD)
- [ ] ENG-XXX-5: Add runbook for similar issues (@oncall, by YYYY-MM-DD)

## Prevention
How we'll prevent this from happening again:

1. **Testing**: Add test coverage for edge cases
2. **Monitoring**: Improve alerting thresholds
3. **Process**: Update deployment checklist
4. **Documentation**: Create runbook for on-call

## Lessons Learned
Key takeaways for the team.

---

回移策略

当修复需要应用到多个分支/环境时：

多环境部署

# 1. Fix applied to main (production)
git checkout main
git cherry-pick <hotfix-commit-hash>

# 2. Backport to release candidate
git checkout release-candidate
git cherry-pick <hotfix-commit-hash>
git push origin release-candidate

# 3. Backport to develop
git checkout develop
git cherry-pick <hotfix-commit-hash>
git push origin develop

# Create PRs for each backport:
gh pr create --base release-candidate --head backport/rc/hotfix-ENG-XXX
gh pr create --base develop --head backport/dev/hotfix-ENG-XXX

处理合并冲突

# If cherry-pick fails due to conflicts
git cherry-pick <hotfix-commit-hash>
# CONFLICT in file.ts

# Resolve conflicts manually
# Then:
git add file.ts
git cherry-pick --continue

替代方案：补丁文件

# Create patch from hotfix
git format-patch -1 <hotfix-commit-hash>
# Creates: 0001-fix-auth-bypass.patch

# Apply to other branch
git checkout release-candidate
git apply 0001-fix-auth-bypass.patch

---

总结

紧急发布速查

决策树

Is production broken?
├─ Yes → Severity level?
│  ├─ P0 (security/down) → Deploy immediately, inform after
│  ├─ P1 (critical bug) → Fast-track PR, deploy same day
│  └─ P2 (major bug) → Standard expedited process
└─ No → Use normal deployment process

时间目标

• P0：问题出现 → 在 2 小时内部署
• P1：问题出现 → 在 4 小时内部署
• P2：问题出现 → 在 24 小时内部署

核心原则

1. 最小改动：只修复当前问题
2. 添加回归测试：防止问题再次发生
3. 快速反馈：先部署到暂存环境（P0 除外）
4. 清晰沟通：及时向相关方通报情况
5. 总结改进：对 P0/P1 进行 PIR

检查清单

• 正确评估紧急程度
• 从生产环境创建热修复分支
• 实施最小修复并添加回归测试
• 使用合适的 PR 标签
• 充分测试（P1/P2 需在暂存环境测试）
• 获得批准（P0 可豁免）
• 部署并进行监控
• 在生产环境验证修复
• 通报状态
• 安排 PIR（P0/P1）
• 创建后续任务

当生产环境问题需要立即处理，并且需要在常规发布流程之外快速部署时，请使用此技能。