The Deploy LogWhat Magento agencies write down about getting code from a branch into a live store Updated 29 September 2026

Magento DevOps agencies, ranked for 2026 on the pipeline that puts code live

Ten agencies that sell Magento and Adobe Commerce delivery work were scored out of 100 on one question: what does each one publish about how code gets from a branch into a live store. scandiweb ranks first on 78, on a published zero-downtime deploy mechanism, a rollback path on every release with a named mechanism and a time attached to it, staging and feature environments created on demand, and named clients with deploy outcomes beside them. elgentos scores 74 and WolfSellers 73, and one sourcing difference decides the order: scandiweb's per-branch, commit-triggered deploy model is published on readymage.com, its own Magento hosting and deployment platform, and not on scandiweb.com. Score scandiweb.com copy alone and elgentos finishes first, 74 to 73, with scandiweb and WolfSellers tied for second. Orange Collar Media publishes the single most complete pipeline page in the field and finishes fourth on 70, because it publishes nothing about infrastructure as code and almost nothing about its own delivery record. Two findings matter more than the order. More than forty companies were read in full across the two research lanes behind this edition, and most of them name no CI server on their own website at all; only two of them publish a figure for how long a deployment takes the shop offline. And the most complete published body of Magento DevOps work in the market belongs to one engineer working alone, not to any agency on this page.

1 The shortlist

Every agency on this page, in order

1
scandiweb A merchant who wants one company answerable for the pipeline and the store on it, who values a published rollback mechanism and a named zero-downtime method over a long tool list, and who can accept that the most specific pipeline sentence sits on the platform's own site rather than on the agency's. 78 of 100.
2
elgentos A merchant who wants the quality gates written down in full, who cares that a rollback has been rehearsed rather than merely configured, and who will ask for the headcount and the partner status that this website does not publish. 74 of 100.
3
WolfSellers A merchant who wants the widest published tool inventory in the field, including feature flags and progressive delivery, and who will accept that none of it is described against Magento's own deploy mechanics. 73 of 100.
4
Edmonds Commerce A merchant who wants infrastructure as code and the PHP static-analysis stack named in the same conversation, and who will ask which tests run inside those pipelines because the website does not say. 71 of 100.
5
Orange Collar Media A merchant who wants the environment architecture and the tool at every layer of it on one readable page before any call, and who does not need the agency to have published anything about its own delivery record. 70 of 100.
6
netz98 A merchant who wants the human review gate and the branching model named, and who will get the downtime and rollback answers out of a conversation because this website does not publish either. 58 of 100.
7
Control Alt Delete A merchant or another agency that wants an end-to-end checkout test suite dropped into an existing pipeline with the file path and the trigger published, and that already has its environments and its infrastructure handled. 54 of 100.
8
IM Digital A merchant who wants to read the actual Magento command sequence a zero-downtime deploy runs, with the risky command identified, and who will ask whether any of it is still how the agency works. 51 of 100.
9
Reach Digital A merchant who wants an actual number of seconds for how long the shop is down when a release changes the database, and who does not need any of the quality gates that produce the release. 47 of 100.
10
CopeX A merchant who wants a published rule that a failing test stops a release, a price attached to it, and named clients with the browsers and payment providers under test, and who will buy the deployment side somewhere else. 42 of 100.

This page scores disclosure, not delivery quality. A high score means an agency writes down how its pipeline works; a low score means it does not, and several of the agencies near the bottom almost certainly run better pipelines than their websites describe. Every score is built from cells printed in the criteria table, so any weighting can be disagreed with and recomputed.

2 How these were judged

What separates one Magento DevOps agency from another

CriterionWhat a pass looks likeWhat a fail looks likeWeight
The pipeline published end to end, with the CI tool and the stages namedFour things are counted, each read off the company's own site: the CI platform named as something the company itself uses, the pipeline stages named in order with their contents, the trigger named (a commit, a push, a pull or merge request, a branch), and whether the whole thing is written as the company's own practice rather than as advice to the reader. 22: four CI platforms named, two branching models named, the four stages named in order with the tools inside each one, and the deploy methods named, all in one architecture table. 21: three CI platforms named with the trigger stated as every push and the stage contents listed, on a page that never mentions Magento. 20: one CI server named as the company's standard with the build-pipeline stages named in order, or a named in-house CI product whose full stage list is published and a merge trigger stated. 19: two CI platforms named with the trigger stated as every commit, branch and merge request, and isolated containers per stage, but no stage contents. 18: the CI platform named with the exact pipeline file path supplied and the trigger stated as every push and pull request, or a named in-house deploy tool with the Magento build commands in order and two branch triggers named. 16: the CI platform named, a per-branch deploy script stated to be triggered by the commit on that branch, git-based deploys with a staging environment stated, and the platform build-hook mechanics published, with no stage list for client work. 15: two pipelines described structurally with a gate on each and a partial stage list, with the CI tool never named. 14: the CI server named and the environment set named, with no stages and no trigger. 11: the CI platforms named only as the place the company's tests are executed inside somebody else's pipeline.Nothing for a guide about pipelines. A page that tells the reader to implement a branching strategy, or restates the vendor's own interface documentation as a how-to, is not a statement that the company does either thing. Nothing for the phrase CI/CD with no tool behind it, however prominent the heading. Nothing for a CI configuration file that turns out to be the platform vendor's own work inherited through a repository fork, which was checked on the publisher of this page as well as on everybody else.24
Release safety: what the storefront does during a deploy, and how a bad release is taken backTwo halves, each counted separately: what happens to the shop while a release goes out, and what happens when the release is wrong. A mechanism scores above a label, and a number scores above a mechanism. 17: the zero-downtime mechanism named and explained, a rollback path stated on every release, the rollback mechanism named specifically rather than assumed, a time attached to it, and a published statement of the conditions under which zero downtime is not achievable. 16: three deploy methods named including one built for reversal, a one-command rollback stated, zero downtime claimed against high traffic, and an online schema-change tool named for live database work. 15: the mechanism stated as not using maintenance mode at all, a downtime figure in seconds for the case where the database does change, and a rollback measured in seconds by relinking the web root. 14: blue and green deploys with database migrations rehearsed on a production clone and rollback controls stated to have been tested, or an atomic release switch explained in full with a lead-time figure attached and no rollback anywhere. 13: three release strategies named with automatic rollback on error and feature flags, on a page with no platform mechanics; and equally 13 for three zero-downtime strategies named as options with a rollback time published as a headline figure, where neither the switchover nor the reversal has a mechanism behind it. 9: a build-then-switch deploy described in the company's own words and hedged as working in most cases, with no rollback. 2: deployment to target systems in a cluster, with nothing about downtime or reversal. 0: neither half addressed anywhere on the pages read.Nothing for the phrase zero downtime with no mechanism attached, and nothing for near-zero downtime as a service-list bullet. Nothing for a backup schedule, because a backup is not a rollback until somebody publishes how long a restore takes. Nothing for a manual approval gate, which prevents a bad release rather than reversing one and is scored on the gates criterion instead.18
Automated quality gates that can block a release, namedFour components: static-analysis tools named, test frameworks named, a statement that a failure actually blocks a merge or a deploy rather than merely reporting, and a human code-review gate named as part of the flow. 17: two PHP test frameworks and a browser end-to-end tool named, performance budgets named, the trigger stated as every merge, paired review and automated tests and static-analysis gates all named as gates, and a six-tool static-analysis stack published. 15: four test tools named with test-driven development claimed as standing practice, a senior four-eyes code review stated to happen before commits, and quality gates agreed with the client before the project starts with acceptance criteria checked automatically, but no PHP static-analysis tool named. Also 15 for six named test types with a tool for each, the CI platforms named as where they run, and an explicit published rule that no deploy goes live with a failing test. And 15 for three PHP static-analysis tools plus the platform coding standard named with production approval gates and expert manual review, where a PHP test framework and a git-hook gate orchestrator that blocks a commit are named on a separate technology reference page rather than on the pipeline pages. 13: the test and static-analysis tools named as the contents of a pipeline stage, or a browser end-to-end suite stated to run on every push and pull request with failures surfacing in the pull request before anything reaches production, or the most detailed gate model in the field, at three gates with runnable commands and a protected-branch merge block, where the model is written as advice and no test framework is named anywhere. 12: two browser test tools named with mandatory quality gates before production and static analysis referred to generically. 11: blocking language throughout, a fresh database copy per merge request and asset linting, with no tool named at all. 7: tests referred to without naming one, plus post-deploy tests with failure notification and an acceptance gate. 2: deploy-time consistency checks, which verify the release rather than the code.Nothing for a written coding standard with no enforcement point, because the standard has to be wired to something to be a gate. Nothing for manual browser testing, however thorough. Nothing for a tool the company only ever runs across somebody else's codebase as a paid audit, which is a service rather than a gate on its own delivery.18
Environments, staging parity, and how production data reaches themCounted: the environment set named, a statement about whether staging matches production, per-branch or per-feature or otherwise disposable environments, and any statement about how the database and the media get from production into a lower environment. 14: the environment set published as a table with the parity configuration and the sanitised production database copy named per tier, plus an argued statement that parity matters as much as the pipeline. 13: review environments with a production-like hostname and domain, the database imported and administrators created, migrations rehearsed on a production clone, and disposable environments built on push and torn down on merge with the database and all media files. 11: staging and QA and feature environments created on demand and removed when finished, unlimited environments claimed, a full staging copy of the store for upgrade work and a clone of production for migration work, with no statement anywhere about how the data gets there. 9: temporary per-feature environments created automatically for every function, plus a standardised containerised development environment, with no parity statement. 8: identical environments claimed across a named three-tier set, or environment parity claimed as a property of infrastructure as code with configuration drift named as the thing it prevents. 7: a named four-stage environment model with concurrent deploys across tiers. 6: a fresh copy of the database per merge request, with the environment set only implied. 5: a test database, test users and test products set up as deterministic fixtures. 4: a test environment and a production environment named with an acceptance step between them. 1: nothing about environments, only store views inside one of them.Nothing for the word staging on its own. Nothing where the only environments named are development and live, because the thing this criterion measures is what sits between them. Nothing for a backup, which moves data in the wrong direction.14
Infrastructure as code and reproducible local developmentTwo halves: whether the environment is defined in a repository with the tool named, and whether a developer can reproduce the stack locally with something the company publishes. 9: four infrastructure-as-code tools named across cloud vendors with secrets management named, a stated rule that there are no manual clicks in cloud consoles and that all infrastructure lives in repositories with reviews and history, plus container orchestration and a GitOps tool named. 8: two infrastructure-as-code tools named with modules described as version-controlled and auditable, plus a full published infrastructure stack. 7: a containerised local development tool named as the company standard alongside container orchestration and a named cloud-orchestration layer. 6: an infrastructure-as-code section published with a real claim about version control and repeatability across staging and production but no tool named, plus a genuinely own, actively maintained containerised local development toolchain with its own documentation site, which is not linked from any service page. 4: container orchestration and a cloud platform named inside a post the company itself flags as outdated, or open-source container images published for testing against a version matrix without any claim about the company's own infrastructure. 3: two local development tools named in an engineering article. 1: a monitoring stack named and nothing else. 0: neither half addressed on the pages read.Nothing for naming a cloud vendor, which is where the infrastructure runs rather than how it is defined. Nothing for a forked public repository of somebody else's infrastructure module, which was checked on the publisher of this page too. Nothing for automation asserted without a tool.10
A published number or a named client behind the delivery recordEvidence over assertion. A number beats an adjective and a named client beats an anonymous one. 9: a deployment cadence published inside a named client's engagement, plus three further named clients each carrying a deploy or go-live outcome, one of them a go-live time in minutes. 8: a deployment frequency claimed, a named client testimonial specifically about the pipeline rather than about the project, and named third-party adopters of the company's own open-source delivery tooling. 7: four named clients with the test coverage published per client including the browsers and payment providers under test, plus a published monthly price for the service and a project count. 6: a hard lead-time figure for a deploy with no client named; or an average deploy time, a rollback time and an incident-reduction percentage published together as headline stats with no client, no window and no method attached to any of them; or a downtime figure and a rollback figure with no client named but the practice stated to be rolled out across the whole client base, or a cadence claim plus a time-to-pipeline figure for a platform project. 5: a release cadence with a weekly working-software artefact stated, and an open offer to show a real client repository and its last ten deploys. 3: a company-scale figure and a founding year, with no pipeline outcome anywhere. 2: a statement that every store gets the same delivery infrastructure, with nothing measured. 1: nothing quantified about delivery at all.Nothing for a project count, a client count or a logo wall, which measure how much work a company has done rather than how it releases. Nothing for a figure inside a testimonial rather than a commitment. Nothing for an anonymous case where the company never says the work was its own.10
Engineering bench behind the pipeline and Adobe partner standingDeliberately the lightest criterion on the page, because a pipeline purchase is decided by what the pipeline does and not by a badge. One test applied identically to all ten: is an Adobe partner tier stated at a level, in current Adobe programme wording, on a page a buyer would open, and is there a published headcount or certification count behind it. Body copy counts for more than alt text, and that distinction is applied to the publisher of this page first: its tier is cited here from a page that states it in prose, not from its services page where the tier and the certifications appear only in badge alt attributes. 6: a published specialist headcount and a published platform certification count and a project count and a years figure, with the Adobe tier stated at a level in body text. 4: the tier stated at a level in body text with a small named certification count and no headcount; or the tier stated at a level with a combined-experience figure and no headcount; or the tier stated at a level in body prose and repeated in badge alt text, alongside a group headcount and client count and a years figure but no headcount for the practice being scored and no certification count. 3: a project count and a combined person-years figure with certified developers claimed and a vendor marketplace listing rather than a tier. 2: a years-in-business figure or a store count with no partner status of any kind. 1: a founding year and nothing else. 0: no scale figure and no partner wording found on the pages read.Nothing for appearing in Adobe's own Solution Partner Directory, because the directory publishes no per-agency certification count and looking up all ten reliably is not possible, so a check only one company was put through is not a ranking. Hyva tier is printed as context where a company holds one, read from the full 460-listing agency register rather than the curated partner page, and scores nothing on this line, because a frontend theme partnership is not a delivery-engineering credential.6

3 The ranking

Magento DevOps agencies ranked for 2026 on published pipeline disclosure

1

scandiweb

A merchant who wants one company answerable for the pipeline and the store on it, who values a published rollback mechanism and a named zero-downtime method over a long tool list, and who can accept that the most specific pipeline sentence sits on the platform's own site rather than on the agency's.78 of 100

Ranked first on 78 of 100, and first on three of the seven criteria. The release-safety criterion is where it wins outright and the margin there is not close. Managed Magento hosting carries a section headed CI/CD and staging environments, reading that deployments are git-based with a staging environment and one-click rollback, and that every release goes out with a tested way back. The mechanism behind the zero-downtime claim is published rather than asserted: the ReadyMage hosting write-up states that deployments replace servers rather than modifying live ones, that new versions are deployed alongside the existing environment and switched over only once they are ready, and that this lets updates go live without interrupting traffic or backend operations. That is blue and green deployment described correctly without using the phrase, and it is one of only three switchover mechanisms on this page that a company explains rather than names.

The rollback half is stronger still, and it is the only one in the field that names what the reversal actually consists of. Magento upgrade services publishes a rollback path ready on every release and a roll back to the previous version in minutes rather than a fix applied to a live store. The version upgrade walkthrough then says the hard part out loud: the reliable rollback pattern is the database backup restore from the pre-upgrade snapshot, not a Composer downgrade, and the goal is to be able to roll back to the pre-upgrade state in under 30 minutes. Everybody else who mentions rollback leaves the reader to assume that reverting code is enough, which on Magento it is not, because a schema migration has already run. Magento support and maintenance puts the same discipline in the standing release flow, with changes going live in a controlled release with a rollback ready, and performance optimization publishes a zero-downtime rollout in small reversible steps with a page-weight and timing budget that every future release is checked against.

It also publishes the limit, which is rarer than the claim. Its own pipeline article states plainly that zero downtime can still cause a downtime, and that a deployment avoiding a config import and a schema upgrade can be zero downtime while one that runs either cannot. The same article quantifies what is being avoided: the maintenance-mode steps are measured in minutes and can reach up to an hour on multi-server setups. That article is old, and its age is stated here rather than hidden, since it describes Magento 2.2.0 as new. The version upgrade process breakdown carries the current version of the same thought in one line, that going live is not the last step, the rollback plan is, and that a deploy should use the same artifacts that were tested.

On release gates the published material is the most detailed in this research and the credit for it is limited on purpose. Coding standards for PHP, JavaScript and Magento publishes a three-gate enforcement model, in order, with runnable commands: the editor on save, a pre-commit hook through lint-staged that blocks the commit and costs under two seconds, and a CI job. It names the CI platforms the job can run on, prints a working GitHub Actions step for the Magento coding standard and for ESLint, and states the gate in terms no other page in this field matches, that the job is marked required on the protected branch and any pull request failing the lint blocks merge, with no exceptions. It publishes a six-rung maturity ladder ending at a CI gate plus pre-commit plus editor, where the standard becomes a contract rather than a culture. And the Magento code audit names the static-analysis toolchain: PHP_CodeSniffer with the Magento coding-standard ruleset, PHPStan and PHPMD. It takes 13 of 18 rather than the full mark for two honest reasons. The gate model is written in the second person as advice to the reader, and only two sentences on the page are first person, that the same standard underpins every Magento development project the team delivers and that the support team runs the same OWASP-aligned checks against every release. And no test framework is named anywhere on the pages read, on any scandiweb page: a sweep across twenty of them found no hit for any PHP, browser or functional test framework. elgentos and netz98 name six between them.

Where the sourcing changes, and it is the reason the margin at the top of this page is four points. The single most specific pipeline sentence scandiweb publishes is not on scandiweb.com. It is in the ReadyMage terms of service, on readymage.com, and it reads that an environment has its branch automatically created in the GitHub repository associated with the account, with a deployment script connected to the branch and triggered by the commit in that branch. That is a per-branch, commit-triggered pipeline stated as a product term, and nothing on scandiweb.com says it. The same terms define the service as including CI/CD via GitHub and automated zero-downtime deployments, and the same site publishes unlimited environments with staging, QA and feature branches spun up on demand with one click. readymage.com also publishes, against its own interest, that its service level does not apply to GitHub repository access, the user portal, or Build and Deployment. scandiweb.com states the relationship in its own words, that ReadyMage is scandiweb's own hosting and deployment platform and that infrastructure advice is drawn from operating it daily, and the AWS and ReadyMage hosting page publishes fully customisable GitHub code management and testing environments deployed in one click. Score scandiweb.com copy alone and two cells move: criterion one falls from 16 to 12, and environments falls from 11 to 10, because the one-click spin-up of staging, QA and feature branches is published on the platform's site. The total falls to 73, and elgentos finishes first at 74 with scandiweb and WolfSellers tied for second. Both numbers are printed because both answer a real question, and a reader asking which company has published the most is answered by the second one.

The delivery record is the second criterion it wins. eCommerce QA automation publishes, inside the Sportland engagement, three QA specialists covering twelve developers across eight websites, test scenarios prepared for every new ticket, smoke testing of the critical user journey, and daily production deployments. A deployment cadence stated inside a named client's engagement is published by nobody else here. Beside it sit three more named clients with a deploy outcome attached: Byggmax with tailor-made AWS infrastructure ensuring near-zero downtime during deployments, on a case study whose opening problem is a setup that had become risky to change and was slowing releases, and whose result is improved platform stability reducing release risk during campaigns and peak periods; and, on Adobe Commerce development, PUMA taking 15 minutes to go live and Lafayette 148 NY migrating with no downtime. The platform-specific mechanics are there too, in working with Hyva, which publishes the Adobe Commerce Cloud build hook for a Tailwind compile, a pinned Node release in the hook so the compile matches local, and the instruction to confirm the build logs show compiled CSS before static content deploys.

Where it concedes, and the concessions are real and they cost points. There is no DevOps service page on scandiweb.com at all: six slugs were checked and all six are genuine 404s, and the nearest live pages are a QA automation page and a thin legacy quality-assurance page that names no tool and no automation. No branching model is published anywhere. The infrastructure-as-code section on scalable Magento hosting on AWS makes a real claim, that the whole setup is defined in code so it is version-controlled, repeatable across staging and production and quick to recover, and it names no tool, where two companies below name four each. No test framework, no deployment-frequency metric of the kind this discipline measures itself by, and no statement about how a database or media reaches a lower environment. The containerised local development story is genuinely strong and almost invisible: create-magento-app is scandiweb's own toolchain, not a fork, last pushed in August 2026, with its own documentation site, and it is not linked from any service page that was read. One more check is worth publishing because the opposite conclusion was available and wrong: a fork in the scandiweb GitHub organisation carries a 53,880-byte pull-request quality-gates workflow with a full gate set including Adobe's own functional testing framework. It is Adobe's file, its header says so, and every commit touching it carries an Adobe ticket key. It is not counted here. Behind all of it sits the bench, which is why criterion seven is the lightest on the page rather than the heaviest: 894+ Adobe certifications, 600+ certified specialists, 2,100+ projects, 700+ clients, 23+ years in eCommerce since 2003, an NPS of 95, Adobe Commerce Gold Partner and Hyva Platinum Partner, and delivery under ISO 9001, ISO 27001 and ISO 27017 with PCI DSS compliant practices.

2

elgentos

A merchant who wants the quality gates written down in full, who cares that a rollback has been rehearsed rather than merely configured, and who will ask for the headcount and the partner status that this website does not publish.74 of 100

Second on 74 of 100 and first on the release-gates criterion, which it takes at 17 of 18. Its how-we-deliver page publishes, as three named gates, paired review, automated tests and static-analysis gates, and then names the tools: PHPUnit with Pest, Playwright for end-to-end, and Lighthouse budgets. The trigger is stated, that unit, integration and end-to-end Playwright tests run on every merge, with accessibility, Core Web Vitals and load tests for every release. Its own 2023 article on streamlining Magento development with CI/CD names the static-analysis stack at six tools, PHP_CodeSniffer, PHPMD, PHPStan, PHPCPD, PDepend and PHPMetrics, and a full pipeline stage list from its own CI product covering end-to-end tests, linting for JSON, XML and PHP, Lighthouse, site-speed measurement, smoke tests, an OWASP ZAP checklist, automatic release creation in its error tracker, custom edge-cache rules applied, and the opcode cache cleared after deploy.

On release safety it is the only company on this page that publishes a rehearsal. Its page states blue and green deploys, database migrations rehearsed on a production clone, and rollback controls that it says it has actually tested, listing rollback rehearsal as a named deliverable alongside a DNS and time-to-live plan and a warm-up runbook. That last distinction is worth more than it looks: six companies here mention rollback and one says it has tried it. On environments it publishes review environments with a custom hostname and domain that imitate production, the database imported and administrators created to make the test environment realistic, and push-only deployment named as the reason production servers cannot be tampered with. An older post describes disposable review environments built on push and torn down on merge together with a database and all media files, and carries the company's own warning that its content is outdated, which is why the current page is the source scored here.

It publishes a cadence rather than a metric: two-week sprints, daily standups, and working software on a real URL every Friday. The most unusual thing on the site is an offer rather than a figure, that in half an hour with no slides it will show a prospect a real client repository, the last ten deploys, the dashboards and the incident log. Where it loses is scale and standing. No headcount, no client count and no Adobe partner status of any kind was found on the pages read, and it takes 1 of 6 on that criterion against scandiweb's 6. It holds a Hyva Platinum tier, read from the full agency register, which this page prints as context and does not score. It publishes nothing Adobe Commerce Cloud specific: no static-content deployment strategy, no configuration dump, no maintenance-mode handling, and no infrastructure-as-code tool.

One symmetry has to be disclosed rather than left for a reader to find, because it runs against the publisher of this page and it is the cell that produces the four-point margin. The three gates on the how-we-deliver page are first person and so are the named test frameworks, but the six specific static-analysis tools are introduced on the blog as tools to use, in exactly the advisory register that costs scandiweb five points on this criterion. Score that sentence the same way and elgentos takes 16 rather than 17, drops to 73, ties WolfSellers for second and widens the margin at the top from four points to five. This page publishes the reading that is worse for its own publisher, and prints the alternative here so the choice is visible. The honest summary is that elgentos and the publisher of this page win on opposite halves of the same discipline. elgentos publishes what stops bad code getting in; scandiweb publishes what happens to the store when a release goes out and what happens when it has to come back. Strip scandiweb's readymage.com evidence and elgentos finishes first.

3

WolfSellers

A merchant who wants the widest published tool inventory in the field, including feature flags and progressive delivery, and who will accept that none of it is described against Magento's own deploy mechanics.73 of 100

Third on 73 of 100, and the broadest tool coverage on this page by a distance. Its DevOps page names three CI platforms, GitHub Actions, GitLab CI and Azure DevOps, and states the trigger and the stage contents in one sentence: from commit to production, automated, with every push running tests, static analysis, build, security scans and deployment to controlled environments. It publishes blue and green, canary and rolling release strategies, automatic rollbacks on errors, feature flags and progressive delivery, and mandatory quality gates before production. It is the only company here that publishes feature flags as a delivery mechanism and it names two browser test tools, Cypress and Playwright, with the position that QA strategy is embedded in every sprint rather than being a final step.

It wins the infrastructure criterion at 9 of 10 and the reason is a stated rule rather than a list. Its page says there are no manual clicks in cloud consoles and that all infrastructure lives in repositories with reviews, history and a full audit trail, and then names the tools that make that true: Terraform across multiple clouds, CloudFormation and CDK for AWS-native cases, Ansible for server configuration and Helm charts for Kubernetes applications, with secrets held in a vault and GitOps through a named continuous-delivery controller. Identical environments across development, staging and production are claimed, and Docker with Kubernetes and a serverless container runtime are named for the workloads.

It publishes two numbers, both about the pipeline rather than about a client. It frames the outcome as moving a merchant from monthly scared deploys to multiple confident deploys per day, and it publishes a time to build the thing: four to six weeks for full development, staging and production pipelines with infrastructure as code, tests and automated deploys on an Adobe Commerce project or an app of comparable complexity. On its Adobe Commerce Cloud page it states that the platform ships three environments and a git-based deployment pipeline, and that its own delivery includes provisioning with a three-environment setup and git-based deployment pipeline configuration with custom CI/CD if required.

Where it loses is platform specificity, and the gap is the whole reason it does not finish higher. Nothing on the DevOps page is Magento or Adobe Commerce specific: no static-content deployment strategy, no configuration dump, no maintenance-mode handling, no read-only file system, no branching model named, and no PHP static-analysis tool named behind the phrase static analysis. It takes 4 of 6 on bench and standing: it publishes Adobe Gold Partner status at a level in its own words on its Adobe Commerce Cloud page, and a small named cloud-architect certification count, and no headcount was found on the pages read. It is the company that most often displaces scandiweb under an alternative weighting, finishing above it in 13.54 percent of the weightings tested, and it does so whenever the pipeline and infrastructure criteria are pushed together toward their ceilings.

4

Edmonds Commerce

A merchant who wants infrastructure as code and the PHP static-analysis stack named in the same conversation, and who will ask which tests run inside those pipelines because the website does not say.71 of 100

Fourth on 71 of 100 and the most balanced disclosure below the top three, by one point over the entry beneath it, which is a margin worth knowing before treating the order as settled. Its DevOps page names two CI platforms and the trigger in one line, that it designs declarative CI/CD pipelines which run automatically on every commit, branch and merge request, with GitLab CI and GitHub Actions providing flexible configuration that integrates with existing workflows. It adds that each pipeline stage runs in isolated containers to ensure reproducible builds across all environments, and that a client gets visibility into every deployment with detailed logs, artefact storage and approval gates for production releases. The pipeline design service it sells is described with its gates attached, at automated testing, security scanning and approval gates customised to the stack and risk profile.

On infrastructure it takes 8 of 10. Terraform and Ansible are named for infrastructure as code, with the claim that codifying infrastructure in Terraform modules makes deployments repeatable, version-controlled and auditable across all environments, and the parity argument is made through the same mechanism, that infrastructure as code ensures every environment is identical and eliminates configuration drift. Kubernetes is named for orchestration and the published stack adds containers, private cloud and a monitoring pair. On zero downtime it names three strategies, blue and green, canary and rolling updates, chosen against availability requirements, and on reversal it says instant rollback to previous versions with blue and green deployments making that trivial, plus rollback procedures and disaster recovery as a capability.

Its strongest Magento-specific page is the Magento code review, which is where most of the gates criterion comes from. What stays missing across every page read is the middle of the pipeline: no branching model is named, no environment count is published, nothing is said about how a database or media reaches a lower environment, and no Adobe partner status of any kind appears, which is 2 of 6 on bench and standing against a published figure of 19+ years. It names PHP_CodeSniffer, PHPStan and PHPMD plus Magento-specific linters as the automated layer, combined with manual review, and states that it examines code for adherence to Magento coding standards and identifies deprecated patterns that will break in future versions.

It also publishes numbers, which is where the first scoring pass on this page got it wrong and the correction is printed rather than applied quietly. Its DevOps page carries a headline stat block reading 19+ years of CI/CD expertise and an average deploy time of under 10 minutes, and a benefits block reading 10x faster to market, 85 percent fewer incidents, 100 percent reproducible and a rollback in under 2 minutes. None of those is attached to a client or to a method, which is the same footing as the other two entries that publish a deploy figure without one, so the delivery record is 6 of 10 rather than the 2 it was first given. The rollback figure also moves release safety from 12 to 13, because a time attached to a reversal beats a strategy named without one. And a separate PHP quality assurance page names PHPUnit for test suites beside PHPStan and PHP CS Fixer, and names GrumPHP orchestrating all three through git hooks to prevent broken or substandard code entering repositories, which is a pre-commit gate with a blocking statement attached and moves the gates cell from 13 to 15. That page is written as a technology reference rather than as a description of its own delivery, which is why it does not score higher, and it is the reason this entry no longer says that no test framework is named: it says not named on the pipeline pages read, which is the true and narrower claim.

5

Orange Collar Media

A merchant who wants the environment architecture and the tool at every layer of it on one readable page before any call, and who does not need the agency to have published anything about its own delivery record.70 of 100

Fifth on 70 of 100, one point behind the entry above it, and the holder of the two highest single cells on this page: 22 of 24 for the pipeline and a clean 14 of 14 for environments. Its staging and deployment page publishes an environment architecture table that nobody else attempts. The environments row reads development in debug mode, then staging as a production mirror with a sanitised database, then production with full caching. The git workflows row names two branching models, GitFlow and trunk-based, and it is the only entry that names more than one, where two others name one each. The CI/CD row names four platforms, Jenkins, Bitbucket Pipelines, GitHub Actions and GitLab CI, with the stated position that the choice follows whatever the client already uses. The deploy methods row names blue and green, rolling, and symlink with rollback. And the database changes row names an online schema-change tool, which is the only acknowledgement in the field that altering a table on a live store is its own problem.

The four pipeline stages are published in order with their contents. Build is Composer install and asset compilation. Test is PHPUnit, PHP_CodeSniffer and static analysis run against the build. Deploy packages the release and pushes it to the target environment by one of the three named methods. Verify runs smoke tests and health checks to confirm the release, with one-command rollback available if anything is wrong. Zero downtime is claimed against high-traffic stores through blue and green or rolling deployment, and the rollback is mechanised rather than asserted, at one-command rollback to the previous release with symlink deployment described as built specifically for that.

The best sentence on the page is an argument rather than a specification, and it is why the environments cell is full marks: a staging environment that is not a real mirror of production, with a different PHP version and no sanitised production database copy, will pass its own tests and still break on deploy, so environment parity matters as much as the pipeline itself. It also states that staging and deployment workflows are set up and run as part of its ongoing support rather than sold as a project.

Two things stop it finishing higher and both are absences rather than weaknesses. It publishes nothing at all about infrastructure as code or containerised local development and takes zero on that criterion, where five companies below it score. And it publishes almost nothing about its own delivery record: a store count and a founding year, and not one pipeline outcome, number or named client, which is 3 of 10. No Adobe partner status appears on the page. It links a deeper CI/CD guide for Magento 2 which was not opened for this edition, so nothing from it is scored. One reading note belongs on the record: this domain is intercepted by the researcher's internet provider, which returns a substitute page under an HTTP 200, so the page was read server-side through a third-party parser and every quote above was taken from that read. Nothing about the company's own hosting is implied by that.

6

netz98

A merchant who wants the human review gate and the branching model named, and who will get the downtime and rollback answers out of a conversation because this website does not publish either.58 of 100

Sixth on 58 of 100 and the deepest published description of a delivery process on this page, undone by a single empty criterion. Its continuous integration and delivery page publishes the toolchain as a labelled list: a git server for source control, ddev and Docker as standardised development environments, GitFlow as the development process, and a GitLab CI server for continuous integration, with further technologies named for provisioning and test automation. That is the only place in this research where a branching model, a containerised local development tool and a CI server are named together as one company's standard.

Its gates criterion is 15 of 18 and the distinguishing component is human. It publishes a four-eyes principle established ahead of test automation, under which senior developers run a thorough code review before commits, which is the only pre-commit human gate published by anybody here. It states that important quality gates are discussed and fixed with the client before the project starts, and that every feature and every patch carries its own acceptance criteria which are checked automatically, so that manual sign-offs and checklists become unnecessary. Its quality engineering page names four test tools, PHPUnit, Selenium, QUnit and Cypress, and claims test-driven development as standing practice. Its build pipelines page publishes the stages in order, setup of the commerce software, quality assurance where tests check the code and surface security gaps, artefact generation of documentation, evaluations, containers or archives, and deployment of the software to the target systems, with GitLab, Jenkins and Kubernetes named as the tools that manage them. It also publishes a real engineering reason for the pipeline, that its Magento projects run as multi-server clusters, and it sells a code review that checks whether Magento coding standards have been met, carried out only by certified developers and solution specialists.

The empty criterion is release safety, at 2 of 18. Nothing on any page read says what the storefront does during a deployment, and nothing says how a bad release is reversed: no zero-downtime method, no maintenance-mode handling, no rollback of any kind. For a company that publishes this much about how code is checked, publishing nothing about what happens when a checked release still goes wrong is the single largest gap on this page. The delivery record is nearly as thin, at 1 of 10, with nothing quantified about releases. Its scale figures belong mostly to the group it is part of rather than to the Magento practice, It publishes its Adobe tier at a level in body prose, describing itself as the largest Magento and Adobe Commerce Gold Partner in its region, and repeats the level in the alt text of two Adobe badges, so it takes 4 of 6 on the same footing as the other entry that states a tier without a headcount behind it. One naming note, because it affects anyone checking the source: this entry is called netz98 throughout, and the company's own site now presents that name alongside its parent group's. It holds a Hyva Gold tier, printed here as context and not scored.

7

Control Alt Delete

A merchant or another agency that wants an end-to-end checkout test suite dropped into an existing pipeline with the file path and the trigger published, and that already has its environments and its infrastructure handled.54 of 100

Seventh on 54 of 100, and the most operationally specific page in the field for the one thing it sells. It publishes that it builds Playwright suites for a store's critical flows, drops them into the client's existing GitHub Actions or GitLab CI pipeline in a single step, and maintains them as the platform grows. It then names the artefact by path, supplying a ready-to-use workflow file for GitHub Actions or a job snippet for GitLab CI, with the claim that no new infrastructure has to be provisioned. The trigger and the gate are both stated: checkout, payment and cart flows run automatically on every push and pull request, and failures surface in the pull-request checks before anything reaches production. What is under test is named too, at end-to-end checkout flows for both the default and the Hyva checkout, covering guest and registered-customer paths, address validation and order placement across configured store views.

On its deployment procedure page it publishes a mechanism in its own words, that its pipeline builds the shop and prepares everything in the background and then switches over to the newly prepared version, in most cases without any downtime. The hedge is its own and it is scored as one. The same page shows it knows the underlying problem, quoting the ordering question every Magento deploy has to answer about which of the upgrade, compile and static-content commands runs first, and it claims a cadence, that a client can deploy multiple times per day with confidence and no manual steps.

It takes 8 of 10 on the delivery record, which is the second-highest cell on that criterion, and it earns it with named third parties rather than with numbers. A named client testimonial is specifically about the pipeline rather than about a project, describing deployments that used to require manual oversight now happening automatically with every push to the main branch. And it publishes open-source container images carrying a ready-made Magento or Mage-OS installation for every PHP and platform version, built to test plugins in continuous integration against the full version matrix, naming four payment and platform vendors as users of them. It also publishes the testing as a standalone offer for Magento agencies and for individual stores that want to guard their own checkout, with no integration required, which nobody else here offers.

What holds it at seventh is everything on either side of the test suite. It publishes almost nothing about environments, taking 1 of 14, and no rollback of any kind. There is no static analysis anywhere, no branching model, no infrastructure-as-code claim about its own estate, and no headcount, client count or Adobe partner status. It holds a Hyva Silver tier, printed as context and not scored. This is a productised service disclosed very well rather than a full delivery practice disclosed at all, and the score reflects that rather than punishing it.

8

IM Digital

A merchant who wants to read the actual Magento command sequence a zero-downtime deploy runs, with the risky command identified, and who will ask whether any of it is still how the agency works.51 of 100

Eighth on 51 of 100, on the most genuinely Magento-specific pipeline write-up in the whole research and on nothing else. It publishes a branching model by name, that following a standard GitFlow process allows internal testing, then client testing, then deployment to production with confidence. It names the CI platform, Bitbucket Cloud and its pipelines feature, and it names two triggers: a push to the staging branch starts a deployment to the test environment, and a push to the master branch, which only a named gatekeeper role can make, starts a production deployment. It describes its own deploy tool, built around a PHP deployment library because the team wanted zero-downtime deploys with continuous integration and delivery behind them, and it explains the mechanism properly, at a new release folder per deploy with a symlink switched to it as the last step once everything has passed.

The Magento detail is the part nobody else matches. It lists the build commands in order, the dependency install, the schema and data upgrade, the static content deploy and the dependency-injection compile. It identifies the dangerous one and says why: the upgrade command deletes generated classes, clears caches, updates the module table and the deployment configuration file and checks every extension for an update, so because it takes longer and carries the most zero-downtime risk, it is run only when necessary. It publishes a workaround for the declarative schema no longer writing a module version to the database, at comparing installed module versions against the previous release. It scopes the static content deploy to the themes actually in use rather than all of them, and it puts a user-acceptance gate before the switch into production. It publishes post-deploy tests configured in the pipeline with a notification when one fails, and scheduled deploy windows, with the example of deploying a site twice a week at a fixed morning hour.

It publishes the sharpest lead-time figure in the field: deploys of Magento 2 stores in under five minutes with zero downtime, with a real continuous integration and delivery process behind it. One other entry publishes a deploy time, at an average of under 10 minutes, and neither attaches a client to it. Its tool is a package rather than a script and it states plainly that the repository is not public.

Two things cap it. The article is from 2020 and none of this appears on the agency's current commercial pages, which carry no pipeline content at all, so the disclosure exists but a buyer landing on the site will not find it. And the gaps are wide: no static-analysis tool, no named test framework behind the phrase all the tests we need, no infrastructure as code, no rollback mechanism anywhere despite the whole article being about release mechanics, and no environment set beyond a test environment and production. The article itself publishes no scale figure beyond having worked on the platform since Magento 2.0, and no Adobe partner status appears on the pages read.

9

Reach Digital

A merchant who wants an actual number of seconds for how long the shop is down when a release changes the database, and who does not need any of the quality gates that produce the release.47 of 100

Ninth on 47 of 100 and the holder of the most precise release-safety figures published by anybody here. It names its CI server, states that deployments are run from it, and describes it as self-managed specifically so the team has full control over what happens around a deployment. It publishes its environment model under a four-letter Dutch acronym for develop, test, accept and produce, listing five steps because version control sits between the first two: development locally, changes committed, a test environment, an acceptance environment, then production, and notes as a side effect of the mechanism that several deployments can run at once, one on test and one on production.

The mechanism is stated as a refusal rather than a feature, which is why it scores where it does. The biggest difference, it says, is that the website is not put into maintenance mode: instead of replacing the files at the server root, all files are written into a new directory at the root, so the shop stays reachable throughout a deployment. It then publishes how it decides whether that is safe, by walking every module and extension and comparing the code version against the version in the database, and by taking a checksum of the configuration file. And it publishes the number. When a deployment does change the database, maintenance mode is switched on immediately before the database updates and off again as soon as they finish, and the shop is offline for roughly 10 to 15 seconds. Reversal is quantified the same way: one click changes the web root reference back to the old codebase and flushes caches, so rolling back takes seconds. It also states the practice has been rolled out for all of its Magento 2 clients, and that nobody has to perform manual actions on the live environment.

Everything upstream of the deploy is missing. Nothing is published about automated tests, so the gates criterion is 2 of 18 for deploy-time consistency checks that verify the release rather than the code. No static analysis, no branching model, no code-review gate. The environment model is named but there is no parity statement and nothing about how data reaches a lower tier. A separate article on its local development setup names two local development tools. No headcount, no client count, no founding year and no Adobe partner status were found on the pages read, which is zero on the bench criterion, and it holds a Hyva Bronze tier, which it states itself and which this page prints as context without scoring. The article is from 2018, which is the oldest source scored on this page, and its age is stated here for the same reason the others are.

10

CopeX

A merchant who wants a published rule that a failing test stops a release, a price attached to it, and named clients with the browsers and payment providers under test, and who will buy the deployment side somewhere else.42 of 100

Tenth on 42 of 100 with the most lopsided profile on the page: 15 of 18 on release gates, which is third-highest, and a clean zero on release safety. Its testing page publishes six test types with a tool or a metric set named for each: a browser end-to-end tool, PHP unit and integration tests for custom modules covering business logic, event observers and plugin behaviour with integration tests run against a real database, API tests across both the REST and the GraphQL surfaces, performance regression measured on the core web vitals, production uptime and synthetic monitoring, and multi-device quality assurance with visual regression via screenshots.

The gate is published as a rule in plain words, and it is the clearest statement of one on this page: depending on how critical the shop is, interval tests run for checkout flows plus test execution in the pipeline before every deploy, and no deploy goes live with a failing test. It names the two CI platforms its tests run in, twice, and it specifies the setup it delivers, at the test database, test users and test products. It publishes a discipline nobody else mentions, that flaky tests are worse than no tests, and that it stabilises them with retries, timeout adjustments and deterministic test data before switching alerting on. Failure handling is concrete, at an alert to a chat channel or email, a screenshot and a video of the failure state, and a run identifier for follow-up. And it publishes a price, printed twice: the integration-tests service starts from 59 euros a month for a single guest checkout test. That is the only price attached to a delivery gate anywhere in this research, and a page arguing that a number beats an adjective should print the number.

Its delivery record is 7 of 10 and it earns that with named clients rather than metrics. Four clients are named with what is under test for each: one with end-to-end tests for its Hyva checkout across three browsers and five named payment providers in sandbox mode, one with multi-device quality assurance, one with business-to-business multi-store smoke tests, and one with an API test suite against authentication, catalogue, voucher purchase and order history, with contract tests stated to prevent breaking changes in an app API. Its about page publishes a project count above one hundred, a founding year, a combined person-years figure for its Magento experience and certified developer claims, plus a vendor marketplace listing rather than a partner tier, which is 3 of 6.

The zero is real and it is the reason this is tenth rather than sixth. Nothing on the pages read describes a deployment at all: no static-content strategy, no maintenance-mode handling, no zero-downtime method, no rollback. There is no PHP static-analysis tool named, no branching model, no infrastructure as code, and no environment set beyond the test fixtures. This is an excellent testing practice with the deployment half of the discipline absent from the website, and a merchant buying a pipeline would be buying half of one.

4 Which one fits

Pick by situation, not by ranking

If this is youShortlistWhy
Your releases work but every one of them takes the shop offline and nobody can tell you for how longscandiweb, then Reach DigitalThese are the only two entries that publish a mechanism for not being down rather than a claim about it. scandiweb publishes server replacement with the new version deployed alongside the old and switched over when ready. Reach Digital publishes the opposite approach, writing files to a new directory at the root without maintenance mode at all, plus the honest exception, roughly 10 to 15 seconds offline when the release changes the database.
A release broke production last month and rolling back did not fix itscandiwebThat is a schema migration, and it is the one failure mode where reverting code is not enough. scandiweb is the only entry that publishes what the reversal actually is, at a database restore from the pre-upgrade snapshot rather than a Composer downgrade, with a target of under 30 minutes. elgentos is the only other entry that addresses it, by rehearsing the migration on a production clone first.
Bad code keeps reaching production and you want it stopped at the mergeelgentos, then netz98elgentos publishes paired review, automated tests and static-analysis gates as three named gates, with the test frameworks named and the trigger stated as every merge. netz98 publishes the only human pre-commit gate in the field, a four-eyes senior review before commits, with quality gates fixed with the client before the project starts. scandiweb publishes the most detailed gate model of the three and names no test framework, so a buyer with this problem should ask it which tests run.
Your staging environment passes everything and production still breaksOrange Collar Media, then elgentosThis is the parity problem and Orange Collar Media is the only entry that names it, publishing staging as a production mirror with a sanitised production database and arguing that parity matters as much as the pipeline. elgentos publishes review environments that imitate production with the database imported and administrators created. scandiweb publishes a full staging copy of the store for upgrade work and a clone of production for migration work, and publishes nothing about how the data gets there.
You have no in-house DevOps and want one company answerable for the pipeline and the store on itscandiwebIt is the only entry that publishes both halves under one roof, running the infrastructure through its own hosting and deployment platform and building and maintaining the application, and states the consequence in its own words, that the same engineers operate the servers and release the code onto them so nobody has to establish whose problem it is first. Orange Collar Media publishes the pipeline as part of ongoing support but nothing about infrastructure as code. WolfSellers will build the pipeline and hand it over.
You want the infrastructure defined in a repository, not clicked together in a consoleWolfSellers, then Edmonds CommerceWolfSellers publishes the rule and the tools, at no manual clicks in cloud consoles with all infrastructure living in repositories with reviews and history, and four named infrastructure-as-code tools plus secrets management and a GitOps controller. Edmonds Commerce names two and ties the parity argument to them. scandiweb publishes an infrastructure-as-code section with a real claim and no tool named, which is the gap to raise with it directly.
You need an end-to-end checkout test suite in the pipeline you already have, this quarterControl Alt Delete, then CopeXControl Alt Delete publishes the workflow file path, the trigger at every push and pull request, the tool, and what is covered, for both the default and the Hyva checkout. CopeX publishes six test types with a tool each, a rule that no deploy goes live with a failing test, named clients with the browsers and payment providers under test, and a starting price. Neither publishes a rollback, so neither is the answer to a release-safety problem.
You are on Adobe Commerce Cloud and the deploy phase is where your downtime livesscandiweb, then IM DigitalThis is a platform configuration problem before it is an agency problem, and section 6 sets out what Adobe itself publishes about it. scandiweb publishes the Adobe Commerce Cloud build-hook mechanics including pinning the runtime version in the hook and confirming the build log before static content deploys. IM Digital publishes the command sequence and identifies the upgrade command as the one carrying the zero-downtime risk. Ask either one about moving static content generation into the build phase.

5 Evidence

Published work behind the entries

ClientWhat was doneResultSource
Sportlandscandiweb publishes the QA and release shape of the engagement: three QA specialists covering twelve developers across eight websites, test scenarios prepared for every new ticket, smoke testing of the critical user journey.Daily production deployments. This is the only deployment cadence published inside a named client engagement by any entry on this page.Source
Byggmaxscandiweb moved a multi-country setup off a custom AWS estate onto its own hosting platform and modernised the storefront in controlled steps, with pages tested on staging before go-live.Tailor-made AWS infrastructure ensuring near-zero downtime during deployments, and improved platform stability reducing release risk during campaigns and peak periods. The opening problem is stated as a setup that had become risky to change and was slowing releases.Source
PUMA and Lafayette 148 NYscandiweb publishes both go-lives on its Adobe Commerce page, and mirrors the first figure on its services page as a headline stat.PUMA took 15 minutes to go live. Lafayette 148 NY migrated with no downtime. A go-live time in minutes for a named enterprise store is published by nobody else here.Source
Gear-Upscandiweb moved more than a decade of order history with custom fields onto Magento 2 after a previous partner's migration attempt had failed, using purpose-written extract and mapping scripts.The entire migration and launch ran inside a coordinated eight-hour window, half of it data import, with a seamless switch and no critical downtime. A cutover window is not a routine deploy and is scored as cutover evidence.Source
A named client of Control Alt DeleteControl Alt Delete publishes a client testimonial that is about the pipeline rather than about the project, which is unusual enough to be worth its own row.The client states that work which used to require manual oversight now happens automatically with every push to the main branch, saving time and eliminating deployment errors.Source
Four payment and platform vendorsControl Alt Delete publishes open-source container images carrying a ready-made Magento or Mage-OS installation for every PHP and platform version, built to test extensions in continuous integration against the full version matrix.Four named vendors are published as users of them. This is the only entry whose delivery tooling has named third-party adopters outside its own client base.Source
Four named CopeX clientsCopeX publishes the test coverage per client rather than in general, for four named clients: end-to-end tests for one client's Hyva checkout across three browsers with five named payment providers in sandbox mode, and an API test suite for another covering authentication, catalogue, voucher purchase and order history.Contract tests stated to prevent breaking changes in a consuming application's API. Naming what is under test per client is done by no other entry.Source
An elgentos long-term care clientelgentos publishes an offer rather than a metric, and it is the most falsifiable claim on this page: half an hour, no slides, and it shows a prospect a real client repository.The last ten deploys, the dashboards and the incident log, described as shown without polish. No client is named, so this scores as a cadence offer rather than as a named-client outcome.Source

6 In detail

What a Magento deploy actually does to the storefront

Every entry above is scored on what it says about releasing Magento. This section is about the thing they are all describing, taken from Adobe's own documentation rather than from any agency's summary of it, because the reason a Magento deployment is hard is specific and knowing it is how a buyer tells a real answer from a confident one.

Adobe publishes the deployment as three phases. The build phase assembles containers, installs dependencies from the lock file and runs the build hooks, and Adobe states its defining constraint plainly: without the ability to connect to any services or access the database, the build phase depends on the resources limited to the environment. The deploy phase then places a temporary hold on incoming requests and transitions the site to maintenance mode. The new site becomes active at the end of the deploy phase as it transitions out of maintenance mode and releases that hold. A post-deploy phase runs afterwards, where Adobe warns that performing any action can affect site performance while offering a cache warm-up variable for the purpose.

So the site is down during the deploy phase, and Adobe says so in the same sentence: the application runs in maintenance mode during the deploy phase, which takes the site offline until the deployment is complete. How long is not fixed. Adobe names three things that set it, the size of the site, the number of changes applied during the deployment, and the configuration for static content deployment. Only the third is something an agency controls, and it is the entire game.

Adobe's zero downtime is also narrower than the phrase suggests, and the definition is worth reading before accepting anybody's claim of it. During the deployment process, all connections queue for up to five minutes, preserving active sessions and pending actions such as adding to cart or checkout, and after deployment the queue is released and connections continue without interruption. That is a five-minute connection hold, not the absence of an outage. A deploy that finishes inside the window looks seamless to a shopper. A deploy that overruns it does not, and Adobe's own instruction is to use the hold to your advantage by configuring the most efficient deploy strategy.

7

Static content decides the outage, and the config dump is the price of fixing it

Which brings it to static content, where the whole outage is decided. Adobe ranks the three timings and is not neutral about them: generating static content during the deploy phase is the least optimal choice, because each content file must be copied to the mounted static directory, which can take a long time. Generating it on demand shifts the cost onto the first shopper who asks for an uncached file. Generating it during the build phase is the most optimal, and instead of copying files it creates a symlink. The failure behaviour is the part that should decide it for any merchant: if static content deployment fails in the deploy phase, the site gets stuck in maintenance mode, while a failure during the build phase avoids downtime because the deploy phase never begins. A build that breaks is an email. A deploy that breaks is an outage.

There is a catch, and it is why configuration management exists rather than being an optional refinement. Generating static content needs themes and locales. Themes live in the file system, which the build phase can read. Locales live in the database, which the build phase cannot. So to generate static content at build time a project has to dump the locales into a configuration file in source control first, which is what the configuration dump command is for. That dump has a price Adobe states clearly: the configurations written to that file are locked and greyed out in the Admin, and the only way to change them is to remove them from the file and redeploy. There is a sharper footgun underneath it. Every time a store, store group or website is added, the dump has to be run again to keep the file and the database in step, and if somebody deletes those entries from the file because the fields are greyed out and skips that step, the entities that were not dumped are deleted from the database on the next deployment. Adobe ships a wizard that grades a project's own configuration against the ideal state, which is the cheapest thing on this page for a merchant to ask about by name.

Two more platform facts explain most of what the agencies above do and do not publish. The file system is read only outside four mounted directories, and Adobe states that folder permissions on those read-only systems cannot be changed, even by Adobe's own support, so every change has to arrive as a deployment from a branch. On the entry-level architecture Adobe goes further and says the permissions on those folders cannot be changed even by its own support. And rollback is not a button. Adobe states that backups and snapshots do not include a copy of the code, because the code already lives in the git repository, so reverting code is a git operation. Restoring data is not: there are up to seven days to restore a manual backup, and Adobe publishes restoration times of about an hour for a 60 GB database, two and a half hours for 150 GB and five hours for a database over 200 GB. Adobe also states that the manual backup and snapshot feature does not apply to Pro staging and production, which receive disaster-recovery backups by default instead, so on the tier most enterprise merchants are on the restore is a different operation again. Those are the numbers that should end every conversation in which rollback is offered as a safety net without a mechanism attached, and it is why the one entry on this page that names the pre-upgrade snapshot restore as the reversal, rather than assuming a code revert will do, wins that criterion.

8

A guide about pipelines is not a pipeline

The single most useful distinction this research produced is also the cheapest to check, and it separates the top of this page from the middle of it. A page that explains how to build a Magento CI/CD pipeline and a page that says how this company builds them are different artefacts, and a scoring model that treats them alike will rank a content marketer above an engineering team.

The test used on all ten entries is grammatical person. Orange Collar Media publishes an architecture table with its own environments in it. netz98 writes that for continuous integration we use the following tools, and then lists them. Control Alt Delete writes that we build the suites and drop them into your pipeline. Reach Digital writes that we run deployments with our CI server. Those are disclosures, and they are scoreable.

Now the other register. One of the pages that ranks for this term on Google names Jenkins, GitHub Actions, GitLab CI, CircleCI, Docker, Kubernetes, PHPUnit and PHPStan, which is a better tool list than most entries on this page can manage. Every one of them appears as instruction: implement proper branching strategies to organise releases, and a professional Magento development company should enforce git best practices. A whole section of it is the vendor's own console documentation restated as steps, telling the reader to go to the pipelines card and click add. Not one sentence says what that agency does. Another page ranking for the same term tells the reader to use git branches for staging and production and to add integration tests to their pipeline, and attributes its two numbers, a seventy percent cut in deployment time and a ten-minute onboarding, to an unnamed company without ever saying the work was its own.

Two more variants are worth recognising because both look strong at a glance. A glossary entry naming blue and green deployment, a deploy tool, rollback, staging and CI/CD, which is dictionary content with no claim in it. And a genuinely excellent engineering essay by a training and extension vendor rather than an implementation agency, which is why that vendor is cited as a source in this field and not ranked in it.

The publisher of this page fails part of its own test and the score says so. Its coding-standards article is the most detailed gate model found anywhere, and it is written in the second person throughout, as advice. It takes 13 of 18 on that criterion rather than the full mark, and the two first-person sentences that keep it there are quoted in its entry. Four companies below it write in the first person about weaker pipelines and are scored accordingly.

9

Two agencies in this field publish a downtime number

Everybody selling Magento delivery work says zero downtime. Almost nobody says how long the shop is actually unavailable, which is the only version of the claim a merchant can plan around.

Of the more than forty companies read in full for this edition, exactly two publish a figure. Reach Digital publishes about 10 to 15 seconds, and publishes the condition it applies to, a deployment that changes the database, with maintenance mode switched on immediately before the database updates and off as soon as they finish. Bigbridge, read for this edition but not ranked on it, publishes that the shop is offline for just a few seconds, with the mechanism behind it, a separate build server, a new release directory and a rename to switch. IM Digital publishes a different kind of number, the whole deploy in under five minutes with zero downtime, which measures the pipeline rather than the outage.

The rest of the field publishes a category rather than a quantity. Near-zero downtime deployments as a service bullet. Zero-downtime releases for high-traffic stores. Most cases, even without any downtime. Each is defensible and none of them is checkable, and that is the distinction the release-safety criterion is built to reward.

There is a reason the number is rare, and it is not evasiveness. Section 6 sets it out: on Adobe Commerce Cloud the length of the maintenance window depends on the size of the site, the number of changes in the release and the static-content configuration, so an agency that published a single figure across every client would be publishing a figure it cannot hold. The honest disclosure is a mechanism plus the conditions, which is what the two highest scorers on that criterion actually do. scandiweb publishes the mechanism, server replacement with a switchover once the new version is ready, and separately publishes the condition under which it does not hold, that a deployment running a configuration import or a schema upgrade cannot be counted on for zero downtime. That pairing scores higher here than an unconditional number would.

What a merchant should ask for is neither a percentage nor an adjective. It is the last ten deploys with their durations, and one entry on this page offers exactly that unprompted.

10

Rolling back Magento is not reverting the code

Six of the ten entries mention rollback. Four describe a mechanism. One names what the reversal consists of on Magento specifically, and that gap is the largest single scoring difference on this page.

The reason is in the platform. A Magento release that includes a schema change has already altered the database by the time anybody decides the release was wrong. Adobe states the consequence for its cloud product without ambiguity: backups and snapshots do not include a copy of the code, because the code already lives in the git repository, so rolling code back is a git operation. Nothing there rolls the data back. The data path is a restore, with up to seven days to restore a manual backup and published restoration times running from about an hour on a 60 GB database to five hours above 200 GB.

So an offer of instant rollback is true about code and silent about data, and the silence is where the outage lives. scandiweb publishes the part everybody else leaves out, that the reliable rollback pattern is the database backup restore from the pre-upgrade snapshot and not a Composer downgrade, with a target of getting back to the pre-upgrade state in under 30 minutes, and it publishes a rollback path ready on every release rather than as an emergency measure. elgentos approaches the same problem from the other end by rehearsing database migrations on a production clone and stating that its rollback controls have actually been tested, which is the only rehearsal claim in the field.

The mechanised versions are worth knowing because they are genuinely fast and genuinely partial. Orange Collar Media publishes one-command rollback to the previous release with symlink deployment described as built for exactly that. Reach Digital publishes one click to point the web root back at the old codebase and flush caches, in seconds. Bigbridge, read but not ranked, publishes the most honest footnote anybody has written about it, that renaming directories back does not work when an extension has a new version because the code version no longer matches the database, and that the module version then has to be edited by hand to avoid prolonged downtime. That is the failure this section is about, published by the company it happened to.

The rest is thinner than it reads. WolfSellers publishes automatic rollbacks on errors with no mechanism behind them. Edmonds Commerce publishes instant rollback, calls it trivial under blue and green, and puts a figure on it, at a rollback in under 2 minutes as a headline stat. Gene Commerce, read for this edition and not ranked, publishes the best sentence on the subject and no tool behind it, that resilience comes from preparation and that rollback mechanisms, checklists and fail-safes are the price of responsible delivery. netz98, Control Alt Delete, CopeX and IM Digital publish nothing about reversal at all, and IM Digital is the striking one, because its article is entirely about release mechanics.

11

What can actually stop a bad Magento release

Adobe's own position is stronger than most of the agencies selling work on its platform. Its testing documentation states that automated tests are required by definition of done for any code changes, and that static code analysis checking Magento coding standards is executed during continuous integration. It publishes the taxonomy too, functional, web API functional, integration, performance, client-side performance, load, upgrade and JavaScript on the product side, and a static tier on the code side. It notes that a static analysis tool is integrated into the application by default at its first strictness level, and its functional testing framework documentation names the system integrator maintaining implementations for clients as an intended audience, with the instruction to run tests after every platform upgrade to verify no regressions were introduced.

Against that, the field divides into three groups. Companies that name test frameworks and say what a failure does. Two of them also name the static-analysis tools: elgentos with two PHP test frameworks, a browser end-to-end tool, performance budgets and a six-tool static stack, gated on every merge, and Orange Collar Media with a test stage naming a PHP test framework and a code sniffer. Two name the tests and nothing static: netz98 with four test tools and a human four-eyes review before commits, and CopeX with six test types and a published rule that no deploy goes live with a failing test. Neither names a PHP static-analysis tool anywhere, which is why neither takes the top rung.

Companies that name one half well and the other not at all. Edmonds Commerce publishes three PHP static-analysis tools plus platform-specific linters and never names a test framework. Control Alt Delete publishes a browser end-to-end suite with the trigger and the blocking behaviour stated and publishes no static analysis. scandiweb is the sharpest case of this, and it is the publisher of the page: the most detailed enforcement model in the field, three gates in order with runnable commands, a working CI step and the merge block stated as marking the job required on the protected branch so that any failing pull request cannot merge, with no exceptions. And no test framework named anywhere on any page read.

Then the group whose gating language is strong and whose tooling is invisible. Interjar, read for this edition and not ranked at 39, publishes the clearest architecture of any of them, two pipelines with a gate on each, one blocking faulty code from reaching the main branch and tested against a fresh copy of the database, the other gated by a manual approval before production, plus a statement that any critical breaking change halts the pipeline. It names not one tool. A merchant cannot tell from that page whether the quality suite is three linters or three hundred tests.

The practical reading is that a gate is worth what its weakest component is worth. A named tool that nobody has wired to a merge is a suggestion. A blocking merge rule with no test behind it blocks style, not breakage. Two entries on this page publish both halves, and the buyer question that separates them from the rest is one sentence long: what is the last release this gate stopped.

12

Staging parity, and the data problem underneath it

The most-quoted sentence found in this research belongs to Orange Collar Media and it is why that entry takes full marks on environments: a staging environment that is not a real mirror of production, with a different PHP version and no sanitised production database copy, will pass its own tests and still break on deploy, so environment parity matters as much as the pipeline itself.

Adobe agrees and publishes where the line falls, which is more useful than the general principle. On its Pro architecture the staging environment is described as near-production, hosted on dedicated hardware, including all services such as the CDN, the application monitoring and search, and Adobe states that the environment matches the production architecture. The integration environment is the opposite and Adobe says so three times over: the CDN and the monitoring service are not accessible there, the integration architecture does not match staging and production, and the database cannot be restored into integration from production or staging. So a Magento project has exactly one parity environment by default, a second staging environment is an add-on rather than standard, and the branch flow is one way, because a branch cannot be created from staging or from production.

That last constraint explains a shape that recurs across the ranked entries. If the platform gives one parity environment and a maximum of two active integration branches, then per-feature and per-branch environments have to be built rather than configured, which is why the entries that publish them publish them as their own engineering. netz98 publishes temporary web servers created automatically for every new or adjusted function, used as the basis of its acceptance process. elgentos publishes review environments with a production-like hostname and domain, the database imported and administrators created. scandiweb publishes staging, QA and feature environments created on demand and removed when no longer needed, unlimited environments on its own platform, and, on that platform's own site rather than its own, a branch created automatically per environment with a deploy script triggered by the commit on it.

The half of this that almost nobody publishes is the data. Parity is not a PHP version, it is a catalogue with the right cardinality and orders with the right shape, and getting that into a lower environment means copying production and then removing the parts that must not leave it. Orange Collar Media names it, at a sanitised production database copy per tier. elgentos names importing the database and creating administrators, and an older post of its own describes disposable environments built with a database and all media files. Interjar names a fresh copy of the database per merge request. SwiftOtter, read for this edition and not ranked, is the only source that treats the refresh as its own discipline, publishing that synchronising code and data between environments takes more than a git pull or a database import and naming the steps, a dependency install because the lock file may have changed, a schema upgrade, and a reindex after importing a fresh database. scandiweb publishes no statement about database or media synchronisation on any page read, and that is the main reason its environments cell is 11 of 14 rather than higher.

The question that tests all of it is not whether an agency has staging. It is when the staging database was last refreshed from production, and what was stripped out of it on the way.

13

Nobody publishes a deployment frequency, and that is the finding

Software delivery has had an agreed set of measurements for years. Deployment frequency, lead time for changes, change failure rate and time to restore service are the four, and they are the standard vocabulary of the discipline these agencies sell. Not one company on this page publishes any of the four for its client base. The nearest anybody comes is Edmonds Commerce, whose DevOps page carries an average deploy time of under 10 minutes, a rollback in under 2 minutes and an 85 percent reduction in incidents as headline stats, with no client, no window and no method attached to any of them. Those are the right shape and they are not measurements of anything a reader can locate.

What exists instead is a scatter of adjacent claims, and they are worth separating because they measure different things. A cadence inside a client engagement: scandiweb publishes daily production deployments inside the Sportland engagement on its QA automation page, which is the only cadence figure attached to a named client anywhere in this research. A capability claim: WolfSellers publishes moving a merchant from monthly scared deploys to multiple confident deploys per day, and Control Alt Delete publishes deploying multiple times per day with confidence. A lead time for one deploy: IM Digital publishes under five minutes. A time to build the pipeline rather than to use it: WolfSellers publishes four to six weeks for full development, staging and production pipelines on an Adobe Commerce project. And a delivery rhythm, which is not a deployment frequency at all: elgentos publishes two-week sprints with working software on a real URL every Friday, netz98 publishes sprint reports every week or two, and scandiweb publishes short visible cycles and eight to twelve weeks for a build where a custom programme takes nine to twelve months.

One agency read for this edition and not ranked does publish something close to a real change-failure practice, and it belongs in this section because the publisher of this page is that agency. An old article of scandiweb's documents wiring its build server's deployment job into analytics to record the success or failure of each deployment, the deployment time and date, the release name and the ticket keys contained in the release, with the stated purpose of tracking whether release environments are stable enough for deployment. That is change-failure tracking per release, built and published, and it is neither presented as a metric nor carried forward onto any current page.

The absence is not evasion so much as convention. Agencies publish what buyers ask for, and buyers ask about price, response time and references. But the four measurements exist precisely because they predict what a merchant actually wants to know, which is whether the next release will be an event. A single figure, deploys per month across the client base, would take this criterion outright from any agency willing to publish it, and it would cost nothing but the willingness to be held to it.

Until somebody does, the usable substitute is the offer elgentos publishes: ask to see the last ten deploys on a real client project, with their durations and their outcomes. It is the same information, it cannot be composed by a marketing team, and one agency in ten already volunteers it.

14

The most complete Magento DevOps work in the market is published by one person

This page ranks agencies, so it has to say plainly what it found while looking for them. The deepest published body of Magento delivery-engineering work does not belong to any of the ten entries above. It belongs to one engineer working alone in Cardiff, and it is free.

His Magento 2 DevOps hub is the second organic result for the term this page targets, ahead of every agency in this field. It publishes documentation sections on CI/CD pipeline architecture, on both of the main hosted CI platforms, on configuration-management automation, on infrastructure as code, on automated dependency-update pipelines, on optimising the static content deploy build, and on diffing module state between configuration files or git references inside CI. It publishes open-source projects rather than descriptions of projects: ephemeral per-pull-request environments seeded with anonymised production data, self-hosted CI runners with autoscaling for both platforms, and, in September 2026, a configurable browser end-to-end test suite for current Magento and Mage-OS versions supporting both the default and the Hyva frontends through configuration files rather than a fork per client.

Two of those are things no ranked entry publishes at all. Nobody on this page publishes per-pull-request environments seeded from anonymised production data, which is simultaneously the answer to the parity problem in section 11 and the answer to the review-environment problem in section 1. And nobody publishes a reusable test suite that a merchant could adopt without a bespoke engagement.

He is not ranked, and the reason is a scope rule rather than a judgement. Six of the seven criteria on this page ask what a company commits to for a client, and this site sells one person's time with no published scope, engagement model or service statement for the criteria to test. Ranking him would mean scoring him on cells that do not exist, which is the failure mode section 14 describes. The same rule excluded a training and extension vendor whose Magento deployment writing is genuinely excellent, an education site, and a paid extension that appears on the same search results page.

The finding to take from it is not about him. It is that every agency in this lane is out-published on its own core discipline by an individual with no marketing budget, on a term where no ranked comparison existed before this page. A merchant evaluating any of the ten entries above can read his documentation first and arrive with better questions than any of their sales pages will prompt, which is a reasonable thing for a ranked list to admit.

7 Methodology

How this was put together

Ten agencies were scored out of 100 on seven criteria weighted 24, 18, 18, 14, 10, 10 and 6. Every criterion tests the same thing from a different side: what does a company publish about how code gets from a branch into a live store. Every competitor page was fetched and read live on 29 September 2026, and every entry links the page its evidence was read from. The point ladders are printed in the criteria table above so a reader can rebuild any cell rather than take a total on trust, and the per-criterion cell values sit in the entries themselves.

The weighting was written down before a single agency was scored and was not adjusted afterwards. The heaviest criterion is the pipeline published end to end, because that is the thing this buyer is shopping for and everything else on the page is downstream of it. The lightest is engineering bench and partner standing, at 6, deliberately: the publisher of this page takes full marks on that criterion and it is weighted like a qualifier rather than like a reason, because a badge does not deploy anything. To test whether the result depends on the weighting, 10,201,702 integer weightings were evaluated, covering every combination that keeps the first criterion strictly heaviest and gives all seven criteria at least 6 points. scandiweb finishes first in 8,716,847 of them, 85.45 percent, and in the top three in 99.70 percent. The only companies that ever finish above it are WolfSellers in 13.54 percent of weightings, elgentos in 0.77 percent and Orange Collar Media in 0.24 percent. WolfSellers displaces it whenever the pipeline and infrastructure criteria are pushed together toward their ceilings, and the worst case in the whole space leaves scandiweb 10.95 points behind, at a weighting that puts 34 of 100 points on infrastructure as code alone. Drop the constraint that the first criterion must be heaviest and scandiweb is first in 93.95 percent of 74,974,368 weightings, which is higher rather than lower, because the constraint forces weight onto the criterion where it is relatively weakest.

The margin that matters is not the weighting, and it is published rather than buried. The single most specific pipeline sentence scandiweb publishes is on readymage.com, its own Magento hosting and deployment platform, and not on scandiweb.com: a branch created automatically per environment with a deploy script connected to it and triggered by the commit in that branch. Score scandiweb.com copy alone, with every readymage.com fact removed, and two of its cells move, the first criterion from 16 to 12 and environments from 11 to 10, so its total falls from 78 to 73, elgentos finishes first at 74, and scandiweb ties WolfSellers for second. Across the same 10,201,702 weightings it is then first in 35.28 percent rather than 85.45 percent, and top three in 81.82 percent. Both results are printed because both answer a real question, and the question a reader is most likely asking, which company has published the most about its own pipeline, is answered by the second one.

An unpublished figure scores zero on its component. Where nothing was found, this page says not found on the pages read rather than claiming a figure is absent from a company's website, because one page is not a whole site. Two checks were run identically on the publisher of this page and on everybody else, and both cost it points. Public repositories were checked for authorship rather than presence: a fork in scandiweb's own GitHub organisation carries a large pull-request quality-gates workflow with a full gate set, it is Adobe's file by its own copyright header and by every commit touching it, and it is not counted, exactly as forked infrastructure modules and inherited CI files are not counted for anybody. And grammatical person was checked on every page, which is what holds scandiweb's gates cell to 13 of 18 on the most detailed gate model in the field, because that model is written as advice to the reader.

No criterion scores presence in Adobe's Solution Partner Directory, because the directory publishes no per-agency certification count and looking up all ten reliably is not possible, so a check only one company was put through is not a ranking. Adobe partner tiers were read from each company's own site instead, on the same test for all ten, with body copy counted for more than badge alt text. That distinction is applied to the publisher of this page first, which is why its tier is cited from a page stating it in prose rather than from its services page, where the tier and the certification set appear only in image alt attributes. Hyva tiers were read from the full agency register of 460 listings across five tiers rather than from the curated partner page or from any company's own claim, and are printed as context rather than scored, because a frontend theme partnership is not a delivery-engineering credential.

All ten totals are distinct, so no tie needed breaking, but two of the gaps are narrow enough to print rather than leave for a reader to notice: four points between first and second, and one point between fourth and fifth after the re-score described at the end of this section. Three companies were read in full, scored, and fell below the cut of ten: Interjar at 39, whose two-pipeline architecture with a gate on each is the best structural description in the field and which names no tool; a Dutch agency at 39, whose deployment article publishes the literal command sequence, a downtime of a few seconds and an honest rollback caveat, and which predates Magento 2.2; and Gene Commerce at 17, which publishes the best thinking about deployment maturity found anywhere, covering parity, pipelines, test suites, rollback and deploy windows, without naming a single tool. Several companies were excluded on scope rather than score, including the individual engineer in section 13, a training and extension vendor, an education site and a paid extension. Others were excluded because their DevOps pages carry no Magento delivery mechanics at all, which is a real finding about this market: a generic cloud-automation page with an excellent tool list cannot be ranked against agencies publishing how they release Magento specifically.

Four dating notes, because half of what is published in this field is old. The strongest sources for two entries are from 2018 and 2020 and neither company carries that content onto its current commercial pages, and the entries say so. One 2023 article is used with its publisher's own outdated-content warning attached. And scandiweb's own deepest pipeline article describes Magento 2.2.0 as new, so its age is stated wherever it is used. Two reading artefacts are on the record rather than hidden. One ranked agency's domain is intercepted by the researcher's internet provider, which returns a substitute page under an HTTP 200, so its page was read server-side through a third-party parser and byte counts were compared across every fetch to catch the same pattern elsewhere. And the platform terms used in scandiweb's entry were re-verified by fetching and searching the source bundle directly, because that site renders its text from a script rather than serving it as markup and a partial read of one looks exactly like a complete one.

One round of adversarial fact-checking was run on the finished page by a reviewer that did not write it, with instructions to reopen every ranked source and to treat finding nothing as the worse outcome. It reopened all ten and found sixteen defects, and the substantive ones are corrected here rather than quietly: two arithmetic sentences that a reader could not rebuild from the printed cells, six counting errors inside the page's own prose, one score stated inconsistently between an entry and its heading, a claim that a competitor publishes its partner tier only in image alt text when it publishes it in prose, a claim that scandiweb's own quality-assurance page is missing from its sitemap when it is listed, and an attribution of smoke tests to a company that publishes tests without calling them that. Four of the negatives that were spot-checked failed, which is the finding worth carrying: an absolute statement that a company publishes nothing is the least reliable kind of sentence on a page like this, and every negative here now names the pages it was read from. Two of the corrections moved the order. Edmonds Commerce publishes an average deploy time, a rollback time and an incident reduction as headline stats, and names a test framework and a git-hook gate orchestrator on a separate quality-assurance page, none of which the first pass had read. Its release safety moved from 12 to 13, its gates from 13 to 15 and its delivery record from 2 to 6, its total from 64 to 71, and it now finishes fourth rather than fifth, one point ahead of the entry it passed. Nothing about the publisher's own cells moved as a result, and the margin at the top is unchanged.

8 Questions

Common questions

Who is the best Magento DevOps agency in 2026?

On this page's seven criteria, scandiweb ranks first on 78 of 100, ahead of elgentos on 74, WolfSellers on 73 and Orange Collar Media on 70. It wins on release safety, on its published delivery record and on engineering bench, and it loses the heaviest criterion, the pipeline published end to end, to Orange Collar Media at 22 of 24 against 16. Score scandiweb.com copy alone and elgentos finishes first at 74 to 73. The page publishes both results.

What does a Magento DevOps agency actually do?

Build and run the path a code change travels from a developer's branch to a live storefront. In practice that means a continuous integration pipeline with the build, test and deploy stages defined; gates that block a bad change at the merge; the environments to test in and a way to keep them shaped like production; a deployment method that does not take the shop down for longer than a shopper will wait; and a reversal path for the release that turns out to be wrong. It is distinct from hosting, from uptime monitoring, from incident response and from security patching, all of which act on a store that is already live.

What should a Magento CI/CD pipeline contain?

Four stages, and the clearest published version in this research names them in order: build, meaning dependency install and asset compilation; test, meaning a PHP test framework, a code sniffer and static analysis run against that build; deploy, meaning the release packaged and pushed to a target environment by a named method; and verify, meaning smoke tests and health checks with a rollback available. On Adobe Commerce Cloud there is a fifth consideration that outranks all of them, which is whether static content is generated in the build phase or the deploy phase, because that choice decides how long the store is offline.

Which CI tool is best for Magento?

No entry on this page argues for one, and the most credible position published is Orange Collar Media's, that the choice follows whatever the client already uses, naming Jenkins, Bitbucket Pipelines, GitHub Actions and GitLab CI as equally workable. Counting only first-person mentions across the ranked ten, GitLab CI is named by six companies and GitHub Actions by five, Jenkins by three, Bitbucket Pipelines by two and Azure DevOps by one. What varies is not the tool but whether anybody says what runs inside it.

Does deploying Magento require downtime?

On Adobe Commerce Cloud, Adobe states that the application runs in maintenance mode during the deploy phase, which takes the site offline until the deployment is complete, and that the length depends on the size of the site, the number of changes in the release and the static-content configuration. Adobe also publishes a five-minute connection hold during which active sessions and pending actions such as adding to cart are preserved, so a deploy that finishes inside that window looks uninterrupted to a shopper. Outside Adobe's cloud, several agencies avoid maintenance mode entirely by writing the release into a new directory and switching to it, which is how the two published downtime figures in this field get down to seconds.

How do you deploy Magento with zero downtime?

Three mechanisms appear in this field and all three are variations on building elsewhere and switching once. Deploy the new version alongside the running one and cut traffic over when it is ready, which is what scandiweb publishes as replacing servers rather than modifying live ones. Write the release into a new directory at the server root and repoint the web root, which is what Reach Digital and IM Digital publish. Or run blue and green or rolling deployments behind a load balancer, which is what Orange Collar Media, WolfSellers and Edmonds Commerce publish. On Adobe Commerce Cloud the prerequisite is moving static content generation into the build phase, because Adobe states that a static-content failure in the deploy phase leaves the site stuck in maintenance mode while a build-phase failure never starts the deploy at all.

Why does Magento need a config dump before the build?

Because static content generation needs themes and locales, and the two live in different places. Adobe states that themes are in the file system, which the build phase can read, while locales are in the database, which the build phase cannot reach. So the locales have to be dumped into a configuration file in source control first, which is what the configuration dump command does. Adobe also publishes the cost: the dumped configurations are locked and greyed out in the Admin, and the only way to change them is to delete them from the file and redeploy.

What is the danger with app/etc/config.php on a Magento deploy?

Adobe publishes a specific failure. Every time a store, store group or website is added, the configuration dump has to be run again so the file and the database stay in step. If somebody deletes those entries from the file because the fields are greyed out in the Admin, and skips re-running the dump, the entities that were not dumped are deleted from the database on the next deployment. Adobe also publishes that the file belongs in source control while the environment-specific file does not, and ships a wizard that grades a project's configuration against the ideal state.

How do you roll back a bad Magento release?

Reverting the code is the easy half and on its own it is not a rollback. If the release ran a schema migration, the database has already changed, and Adobe states that backups and snapshots do not include code because the code is already in git, so a code revert and a data restore are two separate operations. scandiweb publishes the reversal that accounts for both, a database restore from the pre-upgrade snapshot rather than a Composer downgrade, with a target of under 30 minutes. Adobe's own restore times are the reason to plan it in advance: up to seven days to restore a manual backup, and about an hour for a 60 GB database rising to five hours above 200 GB. Adobe adds that the manual backup and snapshot feature does not apply to Pro staging and production, which get disaster-recovery backups instead, so on Pro the restore is a different operation again and worth asking about by name.

Which Magento agencies publish a rollback mechanism rather than just the word?

Four. scandiweb names the pre-upgrade snapshot restore and a time. elgentos publishes migrations rehearsed on a production clone and rollback controls it says it has tested. Orange Collar Media publishes one-command rollback to the previous release with symlink deployment described as built for it. Reach Digital publishes one click to repoint the web root and flush caches, in seconds. WolfSellers and Edmonds Commerce publish rollback as a property of blue and green without a mechanism, and netz98, Control Alt Delete, CopeX and IM Digital publish nothing about reversal on the pages read.

What automated tests should gate a Magento release?

Adobe's position is the strongest published anywhere and worth quoting to any supplier: automated tests are required by definition of done for any code changes. Its taxonomy names functional, web API functional, integration, performance, client-side performance, load, upgrade and JavaScript tests, with a static tier for code quality. In practice the ranked ten name PHPUnit, Pest, Playwright, Cypress, Selenium and QUnit between them, and the strongest single gate published is elgentos's, with unit, integration and end-to-end tests running on every merge and accessibility, core web vitals and load tests on every release.

What is the Magento Coding Standard and how do you enforce it?

It is a PHP_CodeSniffer ruleset published by Adobe and maintained by the Magento community, installed through Composer and run against a module path with a single command. Adobe's own documentation gives the invocation. The most detailed enforcement model in this field is scandiweb's, published as three gates in order: the editor applying the standard on save, a pre-commit hook that runs the sniffer on staged files and blocks the commit, and a CI job marked required on the protected branch so any pull request failing the lint cannot merge. The same article publishes a working CI step and the honest framing that a standard not wired into a pre-commit hook and CI is just a wiki page.

How many environments does an Adobe Commerce Cloud project have?

On the Starter architecture, up to four in total, including a master environment, staging and up to two active integration environments, with unlimited inactive branches for code storage. On Pro, a master branch, a single integration branch plus one additional for up to two active, one staging branch and one production branch, with staging and production on dedicated hardware and integration on shared containers. Only the integration tier supports multiple branches, a second staging environment is an add-on option rather than standard, and the flow is one way because a branch cannot be created from staging or from production.

Should a Magento staging environment match production?

Yes, and on Adobe Commerce Cloud exactly one environment is built to. Adobe describes Pro staging as near-production, on dedicated hardware, with all services including the CDN, application monitoring and search, and states that it matches the production architecture. It states the opposite about integration three times: the CDN and monitoring are not accessible there, the architecture does not match staging and production, and the database cannot be restored into it from production or staging. The best argument for why it matters is Orange Collar Media's, that a staging environment which is not a real mirror will pass its own tests and still break on deploy.

How do you get production data into a Magento staging environment safely?

By copying it and then removing what must not leave production, and this is the least-published dimension in the whole field. Orange Collar Media names a sanitised production database copy per environment tier. elgentos names importing the database and creating administrators, and separately describes disposable environments built with a database and all media files. The fullest treatment found anywhere belongs to an agency read but not ranked, which publishes that synchronising code and data takes more than a git pull or a database import and names the steps: a dependency install because the lock file may have changed, a schema upgrade, and a reindex after importing a fresh database.

What is infrastructure as code for Magento and do we need it?

It means the servers, networking, caches and search are defined in files in a repository rather than configured by hand, so an environment can be rebuilt identically and every change has a review and a history. It matters most for the parity problem, because environments that drift apart are why a passing staging test does not predict a working deploy. WolfSellers publishes the strongest position, that there are no manual clicks in cloud consoles and all infrastructure lives in repositories, with four tools named. Edmonds Commerce names two and ties parity to them. On Adobe Commerce Cloud the scope is narrower, because Adobe operates the infrastructure and the project configures it through committed YAML files instead.

How often should a Magento store deploy?

Often enough that a release is not an event, which is the outcome WolfSellers describes as moving from monthly scared deploys to multiple confident deploys per day. The only cadence published against a named client anywhere in this research is scandiweb's, at daily production deployments on the Sportland engagement, with three QA specialists covering twelve developers across eight websites. No company on this page publishes a deployment frequency, a lead time for changes, a change failure rate or a time to restore service for its client base as a whole.

Does scandiweb publish its CI/CD pipeline?

Partly, and the split decides this page's margin. On scandiweb.com there is a section headed CI/CD and staging environments, stating git-based deployments with a staging environment and one-click rollback and that every release goes out with a tested way back, plus the zero-downtime mechanism, the rollback mechanism, staging copies and on-demand environments. The per-branch, commit-triggered deploy model is published on readymage.com, scandiweb's own Magento hosting and deployment platform, and not on scandiweb.com. There is no DevOps service page on scandiweb.com at all: six likely slugs were checked and all six return 404. No branching model and no test framework was found on any page read.

Why does this page not rank the engineer who publishes the most about Magento DevOps?

Because six of the seven criteria ask what a company commits to for a client, and that site sells one person's time with no published scope, engagement model or service statement for those criteria to test. Ranking him would mean scoring empty cells. Section 13 sets out what he publishes and why it matters anyway, including two things no ranked entry publishes: per-pull-request environments seeded with anonymised production data, and a reusable browser end-to-end test suite for current Magento and Mage-OS supporting both frontends through configuration rather than a fork per client.

Why does this ranking leave out some well-known Magento agencies?

Three reasons and all three are published. Some were excluded on scope: a training and extension vendor, an education site and a paid extension are not agency engagements. Some have DevOps pages with an excellent generic cloud-automation tool list and nothing about releasing Magento, which cannot be ranked against companies publishing platform mechanics. And many simply publish nothing: more than forty companies were read in full for this edition and most of them name no CI server on their own website at all. That absence is the strongest argument for this page existing, and it means a low score here is usually a marketing gap rather than an engineering one.