CI/CD, Publishing & Deployment

# GitHub Actions example
- run: dotnet restore
- run: dotnet build --no-restore -c Release
- run: dotnet test --no-build -c Release
- run: dotnet publish -c Release -o ./publish
- run: docker build -t myapp:${{ github.sha }} .

Common follow-ups: What's the difference between continuous integration and continuous deployment?;How do you structure a pipeline for multiple environments (dev, staging, prod)?

name: CI
on: [push, pull_request]
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-dotnet@v4
        with: { dotnet-version: '8.0.x' }
      - run: dotnet restore
      - run: dotnet build --no-restore -c Release
      - run: dotnet test --no-build -c Release --logger trx
      - uses: actions/upload-artifact@v4
        with: { name: test-results, path: '**/*.trx' }

Common follow-ups: How do you cache NuGet packages between workflow runs to speed up builds?;How do you set up matrix builds testing against multiple .NET versions?

# Canary deployment via Kubernetes traffic splitting
apiVersion: split.smi-spec.io/v1alpha3
kind: TrafficSplit
spec:
  service: myapp
  backends:
    - service: myapp-v1
      weight: 90
    - service: myapp-v2
      weight: 10  # only 10% of traffic hits the new version initially

Common follow-ups: How do you automate canary rollback based on error rate thresholds?;What infrastructure is needed to support traffic splitting for canary deployments?

# GitHub Actions: referencing a repository secret
- name: Deploy
  env:
    CONNECTION_STRING: ${{ secrets.PROD_DB_CONNECTION_STRING }}
  run: dotnet run --project deploy-tool

Common follow-ups: Why shouldn't runtime application secrets be the same as CI/CD pipeline secrets?;How do you rotate a secret without pipeline downtime?

# Pipeline step: apply migrations before deploying app
- name: Apply migrations
  run: dotnet ef database update --project src/MyApp.Data --connection "$PROD_CONNECTION_STRING"

- name: Deploy application
  run: az webapp deploy --resource-group myapp-rg --name myapp --src-path ./publish.zip

Common follow-ups: What's the risk of running migrations automatically on every application startup instead of as a pipeline step?;How do you handle a migration that must run against a very large table without locking it for too long?

# Build once
dotnet publish -c Release -o ./artifacts

# Deploy the SAME artifact to each environment, varying only config
# Deploy to staging: uses staging appsettings/env vars
# Deploy to production: uses production appsettings/env vars (same binary)

Common follow-ups: How do you inject environment-specific configuration into an already-built artifact?;What's the risk of environment-specific compiler directives (#if) breaking this guarantee?

az webapp deployment slot create --name myapp --resource-group myapp-rg --slot staging
az webapp deployment source config-zip --resource-group myapp-rg --name myapp --slot staging --src ./publish.zip
# After verifying staging slot works correctly:
az webapp deployment slot swap --resource-group myapp-rg --name myapp --slot staging --target-slot production

Common follow-ups: What happens to in-flight requests during a slot swap?;How do slot-specific app settings (like connection strings) avoid being swapped along with the code?

# Pipeline step after deployment
- name: Smoke test
  run: |
    response=$(curl -s -o /dev/null -w "%{http_code}" https://myapp.com/health)
    if [ "$response" != "200" ]; then
      echo "Health check failed, initiating rollback"
      exit 1
    fi

Common follow-ups: What's the difference between a smoke test and a full regression test suite for this purpose?;How quickly should a rollback be triggered after a failed smoke test?

# GitOps flow:
# 1. Developer merges PR updating image tag in deployment.yaml
# 2. Flux/ArgoCD controller (running IN the cluster) detects the Git change
# 3. Controller pulls the new manifest and reconciles cluster state to match
# CI pipeline never has direct cluster write access

Common follow-ups: How does GitOps improve the security posture compared to push-based deployment?;What happens if someone makes a manual, undocumented change directly to the cluster?

docker build -t myregistry.io/myapp:${{ github.sha }} -t myregistry.io/myapp:v1.4.0 .
docker push myregistry.io/myapp:${{ github.sha }}
docker push myregistry.io/myapp:v1.4.0

Common follow-ups: Why is deploying with the 'latest' tag considered a bad practice for production?;How do you clean up old, unused image tags from a registry over time?