rollback-runbook

Rollback runbook

rollback_release always reverts the release's task merge commits on the default branch and pushes that revert — production can never ship the bad change again, whatever else happens. What restores the RUNNING service depends on the component's delivery mode:

• dispatch — the previous good release's commit is tagged and the deploy workflow is dispatched at it (Mechanism: workflow_dispatch). No previous release: it dispatches at the revert commit instead.
• on_merge — the revert push itself is the redeploy (Mechanism: revert_push); there is nothing else to trigger.
• batch (desktop, mobile) — nothing is redeployed. Status goes straight to rolled_back: a published desktop build or a store build cannot be unpublished by reverting a git commit, so there is no redeploy for watch_release to follow. See batch-artifact-verification for the yank step.

For dispatch/on_merge, Status becomes rolling_back and you are expected to call watch_release again to follow the redeploy through to rolled_back.

Before you roll back: check what schema the release changed

A code revert is not automatically safe. For each task in release.tasks, get_task_pull_request({ task_id, include_diff: false }) to list files, then look for migration paths: migrations/, db/migrate/, prisma/migrations/, alembic/versions/, V*__*.sql, *.up.sql. Read the up file (get_task_pull_request with the diff, or read_file) for any match.

• Additive — CREATE TABLE/CREATE INDEX, ADD COLUMN that is nullable or has a constant default: reverting the code is safe. The previous version simply ignores the new objects — leave the schema in place; do not drop what the forward migration added.
• Destructive or renaming — DROP COLUMN/DROP TABLE, RENAME COLUMN/RENAME TABLE, ALTER COLUMN TYPE, SET NOT NULL on an existing column: the previous version may not run against this schema at all. If the task's rollback_plan covers it, follow the plan exactly. Otherwise do not call rollback_release — comment the evidence plus "a code rollback would run the previous version against a schema it does not know — needs a human: forward fix or a down-migration first", and stop.