[dodgyb]

This is an interesting read on Config Management which essentially concludes that makefiles with Jenkins (etc.) work best:

https://fortyft.com/posts/ansible-puppet-chef-no-thanks/

For more bells and whistles (and a steeper learning curve) try Escape:

https://escape.ankyra.io/docs/what-is-escape/

[jsntrmn]

Thank you for the article link! It was an interesting read, indeed. I hadn't thought of this seemingly obvious approach, and it's one that won't be too difficult to pitch to management.