The gap between built and working
A green build proves the code compiles. It says nothing about a missing environment variable, a failed migration or a route that 500s on first request. Most outages start in that gap.
Build → provision → verify → promote
ShipSanely keeps the previous release serving while the new one is built and provisioned alongside it. Probes then hit the new release directly. Only when they pass does routing move.
What the probes check
The health endpoint, connectivity to PostgreSQL and Redis, one request against each detected route family, and — if a worker exists — that it consumes from its queue.
Migrations
Schema changes run against a snapshot first. A failed migration blocks promotion with the exact error, and the old release never notices.
Rollback is just re-promotion
Because previous releases are kept warm for a short window, rolling back is a routing change measured in seconds, not a rebuild.
What this means for you
No deploy script, no blue/green configuration, no "deploy on Friday" fear. Push, and either it works or nothing changed.