Simplest solution at the scale and level of reliability that I've had experience with is to effectively say that master is what's live. In other words, a merge to master triggers a deploy under normal circumstances. It'll save you a lot of headaches. That plus one command/click deploy last known good build and feature flagging all major updates pretty much removes the whole deploy process as a significant failure risk.