How We Keep a Trunk-Based Pipeline From Being Reckless
Part 1 covered the mechanism: a fingerprint gate decides whether a change ships in minutes over-the-air or needs a full store release. But a gate that only checks "is this native-safe" says nothing about whether the change is good . If every merge to main can reach production within minutes, your safety net can't be a release train that gives everyone time to notice a problem before it ships — it…
A pipeline designed to keep a trunk-based development process from being reckless works through several key components. First, a PR gate ensures every pull request into the main branch undergoes type checks, lint passes, automated tests and end-to-end checks against a real device build before it can be merged. These steps are non-negotiable requirements for merging code.
E2E testing, which verifies what a unit test can see and what actually happens on a phone in someone's hand, is crucial but receives its own dedicated treatment rather than being seen as an afterthought.
Feature flags serve as the primary safety valve by allowing new code to be shipped without immediately becoming visible to users. A merge puts new code onto every device within minutes - that's deployment. The feature flag then controls whether that code is actually visible, allowing teams to safely iterate without exposing unfinished or risky changes prematurely.
The fingerprint gate, detailed in a previous part, determines whether a change can be shipped instantly in minutes versus needing a full store release. This check, which compares against the exact binary in the store, also enables hotfix routing. During a production incident, a hotfix can be routed from either a snapshot frozen at the last full store release, or the last successful OTA, rather than merging into main which could introduce unrelated changes.
Together, these four components replace the traditional release manager and release train to catch bad code, decouple "shipped" from "visible", ensure main can safely reach production, and pinpoint where hotfixes belong during incidents. This replaces a slower, manual process with faster, more honest feedback loops. A fifth piece involving testing OTA updates against the real production binary is forthcoming.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
