🔗
ServiceNow · Hybrid CI/CD Pipeline — Source Control (DEV/TEST) + App Repository (PROD)
Source Control with apply_remote_changes for DEV & TEST · App Repository Publish → Install for PROD · GitHub Actions sncicd-* actions
Source Control — DEV/TEST App Repo — PROD only ATF Suites Change Management SN Official Limitation
🚫
ServiceNow Official Limitations — 3 Hard Constraints You Cannot Work Around ① Source Control NOT on PROD. Official docs: "Source control integration does not support managing applications on a production instance." Using apply_remote_changes on PROD triggers cascade deletes of configuration-linked data — silent and destructive. ② Publish to App Repo from DEV only. sncicd-publish-app must originate from a non-production (DEV) instance. TEST and PROD instances cannot publish to the App Repository. This is a platform constraint, not a convention. ③ apply_remote_changes = active branch only. The API operates only on the branch currently checked out on the instance. Switch branch in Studio first, then trigger the action — or the wrong code gets applied.
Branch → Instance Mapping Hybrid — Source Control (DEV/TEST) · App Repository (PROD)
💻 feature/* → DEV
Developer codes in Studio manual
Studio → Create Branch
Commit Changes → GitHub push
Open PR → develop
🔵 develop → DEV Instance
Trigger: merge to develop auto
apply_remote_changes API
ATF smoke suite runs
Integration validation
🟡 release/* → TEST Instance
Trigger: release/* cut auto
Install from App Repo (official)
Full ATF regression suite
Auto-rollback if ATF fails 🔄
UAT sign-off + CHG raised
🟢 main → App Repo → PROD
Publish App from DEV App Repo
sncicd-publish-app action
Install on PROD via App Mgr
sncicd-install-app on PROD
Hybrid Deployment Flow Source Control → App Repository → PROD Install
🔵 Source Control Zone — apply_remote_changes (DEV + TEST only)
💻 Developer
feature/*
Studio on DEV
Commit → Push
PR + CI
2 reviews
🔵 DEV Instance
develop
apply_remote_changes
ATF smoke
release/*
branch cut
🟡 TEST Instance
release/*
apply_remote_changes
Full ATF regression
UAT pass
merge main
📦 App Repository
sncicd-publish-app
from DEV instance
version tagged
CAB approve
Install App
🟢 PROD Instance
App Manager
sncicd-install-app
ATF critical path
🟢 App Repository Zone — Publish → Install (ServiceNow recommended for all PROD deployments)
Official GitHub Actions Pipeline ServiceNow/sncicd_githubworkflow · 3 Sequential Jobs
⚙️ Job 1 — Build (PR + push)
sncicd-apply-changes → DEV SC
sncicd-publish-app → App Repo DEV only
out: newVersion → job 2 & 3
🧪 Job 2 — Test (after build)
sncicd-install-app → TEST
sncicd-run-atf-suite (full)
sncicd-rollback-app if ATF fails
🚀 Job 3 — Deploy Prod (master only)
if: push to master/main only 🔒
sncicd-install-app → PROD
ATF critical path post-install
⚠ Publish constraint: sncicd-publish-app must run from DEV only. The App Repository rejects publishes from TEST or PROD. Build job always targets the non-production source instance.
ℹ Active-branch constraint: apply_remote_changes applies changes for the branch currently active on the instance. Ensure Studio is on the correct branch before the workflow runs.
Git Branch Strategy Adapted Git Flow — App Repo publish points on main
main → triggers Publish to App Repo
release/* → TEST (apply_remote_changes)
develop → DEV (apply_remote_changes)
feature/* → DEV (Studio)
hotfix/* → App Repo → PROD direct
📦 App Repo publish point
📦 Publish v2.4 📦 Publish v2.4.1 release/v2.4 back-merge hotfix back feature/INC-1042 hotfix/* main release develop feature
All Scenarios — Happy Path to Worst Case
✅Happy Path
feature/* → PR → develop
CI passes, 2 reviews
apply_remote_changes → DEV
release/* → TEST full ATF
UAT pass → merge to main
📦 Publish to App Repo (DEV)
🟢 Install on PROD via App Mgr
✓ App Repo = PROD mechanism
🚨CI Failure on PR
PR opened → CI triggers
Lint / test / CodeQL fails
PR blocked — cannot merge
Dev fixes same feature/*
CI re-runs on new commit
DEV instance untouched ✓
App Repo never reached
⚠ Never bypass branch rules
🐛Defect in TEST
QA finds bug on TEST
fix/* cut from release/*
Fix built on DEV, committed
PR: fix/* → release/*
Re-deploy TEST via SC
ATF re-run → UAT pass
Back-merge release → develop
⚠ Back-merge mandatory
🔥PROD Incident
Alert fires after install
Find prev stable version
sncicd-rollback-app action
Rolls PROD to prior version
App Repo version history ✓
Fix via normal cycle after
Never touch PROD Studio 🚫
🚫 Rollback = App Repo version
⚡Hotfix (PROD)
hotfix/* cut from main
Fix built on DEV instance
Abbreviated TEST regression
hotfix/* → main (CAB)
📦 Publish hotfix to App Repo
🟢 Install on PROD (App Mgr)
Back-merge → develop ⚠
⚠ Back-merge mandatory
Non-Negotiable Rules
🚫
Never use Source Control on PROD
ServiceNow docs are explicit: apply_remote_changes on PROD triggers cascade deletes of config data. App Repository is the only approved PROD deployment method.
📦
App Repo = PROD gateway
After TEST passes: merge to main → sncicd-publish-app from DEV (version tagged) → sncicd-install-app on PROD via GitHub Actions.
🔁
Back-merge every time
Release branch fix or hotfix must always back-merge to develop. Skip once and the same bug reappears guaranteed in the next release.
⏮️
PROD rollback = App Repo version
Use sncicd-rollback-app GitHub Action. App Repository maintains full version history — rollback to any prior published version in minutes.
🏗️
One scoped app, one repo
Source Control links at app level. Never mix multiple scoped apps in one repo. Each app gets its own GitHub repo, pipeline, and App Repo entry.
🧪
ATF calibrated per environment
DEV → smoke only. TEST → full regression. PROD post-install → critical path only. Never run full regression suite after every PROD install.
feature/* · DEV Studio
develop → DEV (apply_remote_changes)
release/* → TEST (apply_remote_changes)
main → App Repo → PROD (Publish + Install)
hotfix/* → App Repo → PROD emergency
7 Official SN GitHub Actions: sncicd-apply-changes · sncicd-publish-app · sncicd-install-app · sncicd-rollback-app · sncicd-run-atf-test-suite · sncicd-activate-plugin · sncicd-rollback-plugin · CHG · CAB