Most of the pipeline runs without you. One step won’t.
checkout-service builds, tests, and packages itself without a single ping. Before it touches prod, it stops — and waits on a person, not a merge queue.
checkout-service · push to mainnotify — fire and forgetask_human — blocks
Run: acknowledged
What lands on their phone
Approve deploy — checkout-servicenow
Tests passed, image built. Push #482 is ready for prod.
high · time-sensitiveAcknowledgere-alerted ×0
Deploy finished+1m
prod is green — checkout-service #482 is live.
normal
Running unattended.
Why block instead of just ping
A message posted to a channel is read whenever someone happens to look. ask_human turns “notify someone” into control flow the pipeline can actually wait on.
Slack message or email
ask_human
Wakes a person up
no
yes — phone push
Pipeline waits for a real answer
no — assumed sent, moves on
yes — blocks until acknowledged
Re-alerts if ignored
no
every device, until ack or timeout
If nobody answers
deploy proceeds anyway
pipeline halts and says so
Silence is not consent. If nobody answers, the pipeline doesn’t proceed — it stops and says so. Play both endings above.