CI/CD implementation

We build complete CI/CD for your applications: build, test runs, artifact publishing and deployment to dev, test and prod, with approval before production and a quick rollback to the previous version.

from CZK 120,000

3 to 4 weeks, up to 3 applications, each extra one +CZK 30,000. Excl. VAT.

Book a consultation

What we offer

We do not start from scratch. We take our proven templates, adapt them to your applications and hand them over so your team can maintain them and add further applications on its own. A workshop for developers and operations is included.

We work with GitHub Actions, Azure DevOps Pipelines or GitLab CI. The default deployment is GitOps with ArgoCD to Kubernetes. Other targets (for example Azure Container Apps, App Service or AWS ECS) are possible by agreement.

We do not write applications. We work only on infrastructure, cloud and DevOps.

When it makes sense

You deploy by hand or with scripts only one person understands.
Every application has a differently built pipeline and maintaining them takes more and more time.
A release takes hours and rolling back is improvisation.
You are moving to Kubernetes and want to deploy with GitOps.
A CI/CD audit showed gaps you want to fix.

What you get

Repeatable deployments: from commit to dev automatically, to production after approval.
One process for all applications, built on shared templates.
Rollback to the previous version within minutes.
Deployments without static access keys in CI (OIDC federation).
A team that understands the pipelines and can add another application on its own.

DevSecOps implementation in detail →

What exactly we do

Shared foundation: Reusable pipeline templates, branching and versioning conventions, CI sign-in to the cloud through OIDC instead of static keys, an artifact registry (ACR, ECR or GHCR), a GitOps repository for deployments and notifications to Slack or Teams.
A pipeline for each application: Container image build, lint, your existing tests, basic dependency and image scanning in report mode, publishing to the registry tagged by git SHA.
Deployment: An ArgoCD application per environment, automatic deployment to dev, promotion to test and prod, an approval step before production, rollback to the previous version.
Documentation and handover: A description of each pipeline, a "how to add a new application" guide, a recorded 2 to 3 hour workshop.
What another service covers: Blocking security checks, SBOM and artifact signing are a separate service, DevSecOps in the pipeline. Both can be ordered together.

Who works on it

Three people work on the project. It is led by a senior.

Senior, project lead
2.5 days

Responsible for
Designs the shared foundation and conventions, agrees the design with you, reviews every pipeline, runs the workshop, makes risk decisions.

What you get from them
Main contact, design, quality control, workshop
Middle
8 days

Responsible for
Builds the shared foundation: templates, OIDC, registry, GitOps repository and ArgoCD. Handles the harder applications and production deployment.

What you get from them
Working foundation, pipelines for the harder applications
Junior
7 days

Responsible for
Builds pipelines for individual applications from the templates, tests them, writes documentation and prepares the workshop material.

What you get from them
Application pipelines, documentation

We assign work by complexity: juniors do routine work from templates, the middle takes the harder parts, and the senior owns the design, quality control and risk decisions. You do not need to decide who does what. The effort in days is indicative and only explains the price. The price is fixed and does not depend on the days actually worked.

How the project runs

The project has four phases and takes 3 to 4 weeks for three applications. We first build and verify everything on one pilot application, and only then repeat the process for the others. Each extra application adds roughly 2 to 3 days.

Week 1: analysis and design
Goal: Get to know your applications and agree what the result will look like.
- Application inventory: language and build, existing tests, dependencies, target environment, current release process.
- Conventions: branching, versioning, environments, who approves production.
- Choice of the pilot application.
- Check that the target environment (cluster or cloud subscription) is ready.
Output: A short 2 to 4 page design confirmed by you. Who: senior with support from the middle
Weeks 1 and 2: shared foundation and pilot
Goal: Build the foundation and prove it on the pilot application from commit to production.
- Pipeline templates, OIDC federation to the cloud, artifact registry.
- GitOps repository, ArgoCD projects and environments, notifications.
- The complete pilot pipeline and deployment to dev, test and prod.
- Rollback to the previous version verified.
Output: A working foundation and the pilot application deployed the new way. Who: middle, reviewed by the senior
Weeks 2 and 3: the other applications
Goal: Move the remaining applications to the shared process.
- A pipeline for each further application from the template.
- Adjustments for differences (monorepo, several services, a specific build).
- Deployment to all environments and rollback verified for each application.
Output: All applications in scope deployed the new way. Who: junior from templates, harder applications the middle, reviewed by the senior
Week 4: handover and workshop
Goal: Make sure your team uses and maintains the pipelines without us.
- Documentation of each pipeline and a "how to add a new application" guide.
- A 2 to 3 hour workshop for developers and operations, recorded.
- A joint production release run by your person.
- Answers to questions in the channel for 10 working days after handover.
Output: Pipelines handed over, documentation, a trained team. Who: senior runs the workshop, junior prepares the documentation

How we work together

Main contact: The project lead (a senior). Accountable for the result, deadlines, risks and decisions. Day to day you can talk to anyone on the team directly.
Communication: A shared Slack or Teams channel and a ticketing system of your choice. Every question and change leaves a trail.
Kick-off: At the start we confirm the scope, access, contacts and the dates of the key milestones.
Weekly status: A short 15 to 30 minute sync: what is done, what is next, what we need from you and which risks we see.
Final readout: We present the results to your team and management and go through the next steps.
Escalation: Junior → middle → project lead. If a deadline or a major risk is at stake, the project lead contacts you the same day.
Working hours: Working days, 8:00 to 17:00 Central European Time. Production changes happen in a window you choose, always through your change management.

What we need from you

The timeline holds if we have the following. If something is delayed, the schedule moves by the same time and we tell you straight away.

Access to the application repositories (work through pull requests you approve).
Administrator access to the CI platform, or a person who makes the needed settings.
A ready target environment (Kubernetes cluster or cloud subscription) and access to it.
A developer or tech lead for each application to answer questions (about 1 to 2 hours over the project).
Existing tests that can run automatically.
A decision on who approves production deployments.

Access and security

Every team member has their own named account. We do not use shared accounts.
We ask only for the permissions a phase needs. Where read access is enough, we work read-only.
We do not take data out of your environment. Our documents contain only the summaries the result needs.
When the project ends, you remove our access, or we remove it on request and confirm it.
If you wish, we sign an NDA before the kick-off.

What is included and what is not

Included in the price

Shared foundation: templates, OIDC, registry, GitOps repository, ArgoCD
Pipelines and deployment for three applications to three environments (dev, test, prod)
One CI platform
Basic dependency and image scanning in report mode
Documentation, recorded workshop
Answers to questions for 10 working days after handover

Not included: priced separately or on your side

Writing tests and changing application code
Building a Kubernetes cluster or cloud infrastructure (Landing zone and Kubernetes adoption services)
Blocking security checks, SBOM and signing (DevSecOps in the pipeline service)
Database schema migrations, if you do not have scripts for them yet
Licences for the CI platform and runners

If we find during the project that reality differs from what we assumed, we tell you before we work outside the scope. We send a short estimate of the impact on price and timeline and continue only once you agree.

Deliverables and acceptance

Deliverable	Contents	Form
Templates	Reusable pipeline templates and conventions	In your repository
Pipelines	Build, tests, publishing and deployment for each application	In your repository
GitOps	Deployment repository and ArgoCD configuration	In your repository
Documentation	Pipeline description, guide for adding an application	Markdown in the repository
Workshop	Training for developers and operations	Online or on site, recorded

The project is done when:

Every application in scope deploys automatically from commit to dev, and to production after approval.
Rollback to the previous version is verified for every application.
Your person has run a production release alone, following the documentation.
The workshop has taken place and we have handed over the documentation.

We hand over the deliverables and go through them with you. We incorporate comments in one round within 5 working days of receiving them.

Risks and how we handle them

Risk	How we handle it
An application cannot be built reproducibly	We fix the build scripts and configuration. If the code needs a change, we describe it and your developers make it.
Tests are flaky	We mark flaky tests and do not run them as blocking until they are fixed.
The target environment is not ready	We find out in the first three days and propose a solution before we start building.
There are more applications than assumed	Each extra application costs CZK 30,000. You confirm the scope in advance.

Price and terms

from CZK 120,000 excl. VAT for the first three applications, each extra application +CZK 30,000.

Duration: 3 to 4 weeks for three applications.
Templates and pipelines stay in your repository and you can keep changing them. Terms of use for templates from our catalogue are set in the contract.
Prices exclude VAT, invoiced in CZK or EUR.
Work outside the scope: a separate quote, always in advance.

What can follow

Next steps

1A short 30 minute call: we look at your environment and check that the service fits what you need.
2We confirm the scope, the start date and the contact people.
3We send the contract and the list of access we need to start.

Frequently asked questions

Do we need Kubernetes?

Not necessarily. The default is deployment with ArgoCD to Kubernetes; other targets (Container Apps, App Service, ECS) are possible by agreement. We confirm the price after the analysis.

We use GitLab, not GitHub. Is that a problem?

No. We work with GitHub Actions, Azure DevOps and GitLab CI. One platform is included in the price.

Will you write tests?

No. We run your existing tests. If tests are missing, we point it out and recommend where to start.

Tell us what you are working on.

Thirty minutes, free. We reply within one working day.