DevOps: What We Use to Build Software in 2025
It’s been a few years since I last wrote about what we use to build software, and with the launch of our new site, I thought it was a good time to revisit and update.
We’re still a small software team, and we lean even more heavily on technology to help us stay on top of our game.
1. Github
Like a hell of a lot of people, we still use Github to host our repositories. But over the years, we’ve expanded how we use it, taking advantage of more of their features to automate our workflow.
Source Code Hosting
We haven’t changed much here. We still use a simplified git flow model, but we’ve switched from rebasing to classic merge commits to better support semantic release. This gives us automated versioning based on conventional commits while preserving the full history of our development. The Github UI for pull requests remains central to our review process, though we’ve enhanced it with additional automation (more on that later).
Dependabot
Security is more important than ever, and Dependabot has become an essential part of our workflow. It automatically creates pull requests when our dependencies have updates available, with a focus on security patches.
By configuring Dependabot to run daily on all our repositories, we ensure we’re never far behind on critical updates. Combined with our automated testing and merge processes, most security patches get applied without any developer intervention at all.
Actions
Github Actions has become the backbone of our CI/CD pipeline. We’ve migrated all our Travis CI workflows to Actions, and we’ve gone much further, automating everything from deployment to documentation generation.
Our most valuable Actions workflows include:
- Automated testing and linting on every push
- Building and deploying to Digital Ocean on merges to feature branches
We’re also Slack addicts, so we’ve got Github plugged right into our channels to keep us updated throughout the day, with custom notifications for the events we care about most.
Alternatives
GitLab and Bitbucket are both still solid repository hosts. GitLab in particular has made great strides with their integrated CI/CD pipeline, but we’re too invested in the Github ecosystem to consider switching.
2. SonarCloud
We’ve migrated from Codacy to SonarCloud for our code quality analysis. SonarCloud not only checks for code smells, bugs, and vulnerabilities but also provides deeper insights into technical debt and overall code health.
The integration with Github Actions is seamless, making it easy to run analysis on every pull request. We particularly appreciate the “Quality Gate” feature, which gives a clear pass/fail status based on our defined quality criteria.
The Github and Slack integrations ensure we know immediately when we’ve introduced a code quality issue, and the detailed explanations help us understand why certain patterns are problematic.
Alternatives
Codacy is still a strong option, and we used it happily for years. CodeClimate also remains a viable alternative.
3. Digital Ocean
After years on Heroku, we made the switch to Digital Ocean, and it’s been a positive move for our team. Digital Ocean offers a good balance of simplicity and control, with multiple hosting options that fit our various project needs.
App Platform
We migrated to Digital Ocean’s App Platform from Heroku following the great breach of 2022, and haven’t looked back since.
The UX isn’t as nice, but it turns out that we barely use the site itself, nearly everything is done automatically via Github Actions, using the doctl action.
App Platform gives us similar benefits to what we loved about Heroku - managed SSL, automatic scaling, and no server management - but with better pricing and performance.
Managed Databases
We primarily use PostgreSQL for databases, and Digital Ocean’s Managed Database offering is top-of-the-line.
Their managed PostgreSQL databases include automated backups, standby nodes for high availability, and easy scaling - all without us having to worry about the underlying infrastructure. The metrics dashboard gives us visibility into performance, and we can set up alerts for unusual activity.
Alternatives
There are a lot of options for managed hosting nowadays, from the classic AWS RDS to the “serverless” Neon. Personally, for a big boring thing like a database, I’d recommend going with a big boring provider, but maybe I’m just old and cynical.
Droplets
We still have a few projects hosted on VPSs, or as they’re called in Digital Ocean land, Droplets.
Again, we automate everything we can. We use Ansible for configuration management, and deployments are done using rsync or pm2.
For new projects, we prefer the App Platform, but Droplets provide the flexibility we need for legacy applications or special cases where we need more control over the environment.
Alternatives
AWS EC2, Google Compute Engine, and Linode all offer similar VPS options. Digital Ocean’s simplicity and predictable pricing work best for our team.
4. Cloudflare
We put Cloudflare in front of all of our sites. In the cloud-native world that we live in, having a layer between the public internet and our cloud hosting provider lets us mitigate even more threats, leading to safer sites and servers.
Cloudflare provides us with:
- DDoS protection
- Web application firewall
- Content delivery network
- SSL management
- Page rules for redirects and optimisations
What we particularly appreciate is how set-and-forget it is. Once configured, it just works, silently protecting our applications and improving their performance.
Alternatives
AWS CloudFront combined with Shield for protection, Fastly, and Akamai are all viable alternatives, but Cloudflare’s generous free tier and ease of use make it the clear winner for our team.
5. Sentry
Error tracking remains critical to our operations, and we’ve switched from Bugsnag to Sentry for this essential function.
Sentry’s improvements in recent years, particularly its enhanced Slack integration, pulled us back after we had previously moved away. The ability to triage, assign, and resolve issues directly from Slack fits perfectly with our workflow.
Other features we love about Sentry:
- Performance monitoring
- Session replay to see what users were doing when errors occurred
- Better grouping of similar errors
- Release tracking that ties errors to specific deployments
The integration with our Github Actions workflow means we can automatically associate errors with the commits that introduced them, making it easier to track down and fix issues.
Alternatives
Bugsnag is still a strong contender and served us well for years. Rollbar is another alternative worth considering.
6. Mergify
As you may have gathered, we love a bit of automation here at Etch, and this handy little tool ties it all together for us.
Mergify has transformed how we handle pull requests. Dependabot PRs get auto-approved and merged after their status checks pass, reviews are automatically requested, and our own PRs are automatically merged when approved.
This might sound like a small thing, but it’s eliminated a surprising amount of busywork from our day. No more waiting for CI to pass, then clicking the merge button, then waiting for deployment. Everything flows automatically once the right conditions are met.
Some of our favourite Mergify rules:
- Auto-merge security patches overnight if all tests pass
- Automatically request reviews from the right team members
- Close stale PRs that haven’t been updated
- Automatically update branch when it becomes outdated
10/10, would recommend to any team.
Alternatives
Github’s own auto-merge feature covers some of this functionality, but lacks the flexibility and power of Mergify. Kodiak is another alternative with similar features.
It’s fascinating to see how our toolchain has evolved over the years. The common thread remains: we automate everything we possibly can, and we make sure all our tools talk to each other (and to us through Slack). This lets our small team punch above our weight, focusing on building great software instead of managing infrastructure or clicking through repetitive tasks.
What DevOps tools are you using in 2025? Have you found any gems we should check out? Feel free to reach out and let us know!