AI
Why Static Workflows Break as Projects Scale
Thomas Bissell manages DevOps automation for dozens of manufacturing projects at Pfizer Global Supply. Writing a custom workflow per project meant rewriting every time requirements shifted.
“I would be going nuts if I had to have a special custom little workflow” — Thomas Bissell
Static matrices work when the permutation space is fixed at write time (three Node versions, say). When the space varies by project, environment, or date, a static matrix breaks. A dynamic matrix derives its permutation space at runtime, so the same workflow handles any number of inputs without modification.
Deriving a Secret Matrix from a Properties File
Multiple Spring Boot projects each needed an unknown number of secrets injected into EKS as environment variables. The permutation space (how many secrets, which names) differed per project. A setup job greps the Spring Boot properties file, matches every environment variable reference with a regex, and appends each name to a JSON array. A downstream job runs once per secret, pulling the name from the matrix and the value from GitHub Secrets by dynamic reference. Two secrets in the properties file produce two parallel job runs.
Deploying All Microservices Without Naming Them
Different repositories held different stacks of microservices, each with its own Kubernetes deployment YAML. Hardcoding service names in a workflow would mean editing the workflow every time a service was added or removed. Instead, a setup job iterates through the deployments directory, adds every filename to a JSON array, and outputs that array as the matrix. The deployment job then runs in parallel for each file, applying it to EKS. Two deployment files in a repository produce two parallel runs. The workflow never needs to know the service names in advance.
Notable Quotes
I would be going nuts if I had to have a special custom little workflow Thomas Bissell · ▶ 1:13
The world is your oyster. Thomas Bissell · ▶ 9:34
Workflows should be made generic so you can save yourself time and overhead, Thomas Bissell · ▶ 9:57
Key Takeaways
- A setup job that outputs a JSON array turns any repository artifact into a parallel matrix.
- GitHub secrets can be referenced by dynamic names, making key-value injection scriptable.
- One generic workflow handles unlimited projects; write it once, reuse it everywhere.