Week 1:
Developer writes code → Tests locally on their laptop → "It works on my machine!"
  ↓
Week 2:
Developer hands code to QA team → QA finds bugs → Developer fixes → Repeat
  ↓
Week 3:
QA approves → Code sent to Operations team → "Please deploy this to production"
  ↓
Week 4:
Operations team reviews code → Finds incompatible dependencies → Rejects deployment
  ↓ "Your code needs Python 3.9, but production has Python 3.7"
  ↓ Developer rewrites code
  ↓
Week 6:
Operations finally deploys → Manually copies files to server → Restarts application
  ↓ Application crashes (forgot to update database schema!)
  ↓ Operations rolls back manually
  ↓
Result: 6 weeks to deploy, deployment FAILED ❌

Monday 9:00 AM:
Developer writes code → Commits to GitHub
  ↓ (30 seconds)
Automated pipeline starts automatically:
  ↓ Step 1: Build code (2 min)
  ↓ Step 2: Run 500 automated tests (3 min)
  ↓ Step 3: Security scan for vulnerabilities (1 min)
  ↓ Step 4: Deploy to Dev environment (1 min)
  ↓ Step 5: Run smoke tests (1 min)
  ↓ Step 6: Deploy to Staging (1 min)
  ↓ Step 7: Run integration tests (2 min)
  ↓ Step 8: Deploy to Production (1 min)
  ↓
Monday 9:12 AM:
Code is live in production ✅

Total time: 12 minutes
Human intervention: 0
Errors: Caught automatically by tests

Worker 1: Builds car frame (manually welding, 8 hours)
  ↓ Hands to Worker 2
Worker 2: Installs engine (manually, 6 hours)
  ↓ Hands to Worker 3
Worker 3: Paints car (manually, 4 hours)
  ↓
Total time: 18 hours per car
Quality: Inconsistent (human error)
Cost: $50,000 per car

Station 1: Robot welds frame (15 minutes)
  ↓ Automatically moves to Station 2
Station 2: Robot installs engine (10 minutes)
  ↓ Automatically moves to Station 3
Station 3: Robot paints car (12 minutes)
  ↓
Total time: 37 minutes per car
Quality: Perfect every time (machines don't make mistakes)
Cost: $15,000 per car

Developer A works on feature for 2 months (doesn't merge code)
Developer B works on different feature for 2 months (doesn't merge code)
  ↓
Month 3: Both developers try to merge
  ↓ 500 merge conflicts!
  ↓ 2 weeks to resolve conflicts
  ↓ Tests fail everywhere
  ↓ 2 more weeks to fix tests
Result: 1 month wasted on integration ❌

Developer A commits small change (20 lines)
  ↓ Automated tests run (5 minutes)
  ↓ If tests pass → Code merged automatically ✅
  ↓ If tests fail → Developer fixes immediately (10 minutes)
  ↓
Developer B commits small change (30 lines)
  ↓ Automated tests run (5 minutes)
  ↓ Tests pass → Merged ✅
  ↓
Result: No integration problems! ✅

Friday 5:00 PM: "We're ready to deploy!"
  ↓ Operations team: "We need to schedule maintenance window"
  ↓ Saturday 2:00 AM: Operations manually deploys
  ↓ 2:30 AM: Deployment fails (missing configuration file)
  ↓ 3:00 AM: Operations calls developer
  ↓ Developer (sleeping): Doesn't answer
  ↓ 3:30 AM: Application still down
  ↓ 8:00 AM: CEO wakes up, website still broken, loses $500k in sales
Result: Failed deployment, exhausted team, angry CEO ❌

Developer commits code → Tests pass → Automatically deploys to production
  ↓ If deployment fails → Automatically rolls back to previous version
  ↓ Total time: 12 minutes
  ↓ Human involvement: 0 (happens during business hours, not 2 AM)
  ↓ Deployment succeeds 99.9% of the time
Result: Reliable, fast, no weekend emergencies ✅

Step 1: Developer commits code
  ↓ git commit -m "Add user login feature"
  ↓ git push origin main
  ↓
Step 2: GitHub detects commit
  ↓ Webhook triggers pipeline
  ↓
Step 3: Create fresh build environment
  ↓ GitHub spins up Ubuntu VM (30 seconds)
  ↓
Step 4: Install dependencies
  ↓ npm install (downloads 1,247 packages in 45 seconds)
  ↓
Step 5: Run linter (check code quality)
  ↓ eslint finds 3 style errors → Build FAILS ❌
  ↓ Developer fixes errors, commits again
  ↓
Step 6: Run unit tests
  ↓ 247 tests run (2 minutes)
  ↓ All tests pass ✅
  ↓
Step 7: Run security scan
  ↓ Checks for known vulnerabilities in dependencies (1 minute)
  ↓ Finds 1 critical vulnerability in old package
  ↓ Build FAILS ❌
  ↓ Developer updates package, commits again
  ↓
Step 8: Build application
  ↓ Compile TypeScript → JavaScript (1 minute)
  ↓ Minify/optimize code (30 seconds)
  ↓ Create Docker container (1 minute)
  ↓
Step 9: Deploy to Dev environment
  ↓ Push Docker container to Azure Container Registry (30 seconds)
  ↓ Deploy to Azure App Service Dev slot (1 minute)
  ↓ Run smoke tests (30 seconds)
  ↓ All tests pass ✅
  ↓
Step 10: Deploy to Staging
  ↓ Deploy to Azure App Service Staging slot (1 minute)
  ↓ Run integration tests (2 minutes)
  ↓ Load test with 1,000 simulated users (1 minute)
  ↓ All tests pass ✅
  ↓
Step 11: Deploy to Production
  ↓ Wait for manual approval (human clicks "Approve" button)
  ↓ Blue-Green deployment (swap staging → production)
  ↓ Deployment completes in 5 seconds
  ↓ Monitor for 5 minutes (check error rates, latency)
  ↓ Everything looks good ✅
  ↓
Result: Code is live! Total time: 12 minutes (most is automated)

1. Source Control (Git)
   ↓
2. Build (Compile code, install dependencies)
   ↓
3. Test (Run unit tests, integration tests)
   ↓
4. Security Scan (Check for vulnerabilities)
   ↓
5. Package (Create deployable artifact)
   ↓
6. Deploy to Dev (Automatic)
   ↓
7. Deploy to Staging (Automatic)
   ↓
8. Deploy to Production (Manual approval)

# Create directory structure
mkdir -p .github/workflows

# Create workflow file
touch .github/workflows/ci-cd.yml

my-repo/
├── .github/
│   └── workflows/
│       └── ci-cd.yml    ← Your pipeline definition
├── src/
├── tests/
└── package.json

# .github/workflows/ci-cd.yml
name: CI/CD Pipeline

# When to run: On every push to main branch
# Why both push and pull_request? Push triggers deploy to staging/prod.
# Pull_request triggers build+test only (validates the PR before merge).
on:
  push:
    branches:
      - main
  pull_request:
    branches:
      - main

# Jobs: A workflow can have multiple jobs (run in parallel or sequence)
jobs:
  build-and-test:
    # ubuntu-latest is the cheapest runner (~$0.008/min for private repos).
    # Only use windows-latest ($0.016/min) or macos-latest ($0.08/min)
    # if your app specifically requires those operating systems.
    runs-on: ubuntu-latest
    
    # Steps: What to do
    steps:
      # Step 1: Checkout code (download your repository)
      - name: Checkout code
        uses: actions/checkout@v3
      
      # Step 2: Setup Node.js
      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: '18'
          # Enabling cache here saves 30-60 seconds per build by reusing
          # previously downloaded npm packages. Over hundreds of builds
          # per month, this saves significant CI minutes (and money).
          cache: 'npm'
      
      # Step 3: Install dependencies
      # Use 'npm ci' instead of 'npm install' in CI pipelines.
      # npm ci is faster (skips dependency resolution), more reliable
      # (uses exact versions from package-lock.json), and fails if
      # package-lock.json is out of sync -- catching a common dev mistake.
      - name: Install dependencies
        run: npm ci
      
      # Step 4: Run tests
      - name: Run tests
        run: npm test
      
      # Step 5: Build application
      - name: Build application
        run: npm run build

name: Build, Test, and Deploy

on:
  push:
    branches: [main]
  workflow_dispatch:  # Allow manual trigger

env:
  NODE_VERSION: '18'
  AZURE_WEBAPP_NAME: 'mywebapp-prod'

jobs:
  # Job 1: Build and Test
  build-and-test:
    runs-on: ubuntu-latest
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      
      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: ${{ env.NODE_VERSION }}
          cache: 'npm'  # Cache node_modules for faster builds
      
      - name: Install dependencies
        run: npm ci  # ci = clean install (faster, more reliable)
      
      - name: Run linter
        run: npm run lint
        continue-on-error: true  # Don't fail if linting fails
      
      - name: Run tests
        run: npm test
      
      - name: Build application
        run: npm run build
      
      - name: Upload build artifacts
        uses: actions/upload-artifact@v3
        with:
          name: dist
          path: dist/
          retention-days: 1  # Keep artifacts for 1 day
      
      - name: Run security scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          format: 'sarif'
          output: 'trivy-results.sarif'
      
      - name: Upload security results
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'

  # Job 2: Deploy to Azure App Service
  deploy:
    runs-on: ubuntu-latest
    needs: build-and-test  # Wait for build-and-test to succeed
    if: github.ref == 'refs/heads/main'  # Only deploy from main branch
    
    steps:
      - name: Checkout code
        uses: actions/checkout@v3
      
      - name: Download build artifacts
        uses: actions/download-artifact@v3
        with:
          name: dist
          path: dist/
      
      - name: Setup Node.js
        uses: actions/setup-node@v3
        with:
          node-version: ${{ env.NODE_VERSION }}
      
      - name: Azure Login
        uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}
      
      - name: Deploy to Azure App Service
        uses: azure/webapps-deploy@v2
        with:
          app-name: ${{ env.AZURE_WEBAPP_NAME }}
          package: './dist'
          startup-command: 'npm start'

# Create service principal
az ad sp create-for-rbac \
  --name "github-actions-sp" \
  --role contributor \
  --scopes /subscriptions/{subscription-id} \
  --sdk-auth

# Output (save this JSON):
{
  "clientId": "...",
  "clientSecret": "...",
  "subscriptionId": "...",
  "tenantId": "..."
}

name: Multi-Environment Deployment

on:
  push:
    branches: [main, develop]

jobs:
  deploy-dev:
    if: github.ref == 'refs/heads/develop'
    runs-on: ubuntu-latest
    environment: development  # GitHub environment
    steps:
      - uses: actions/checkout@v3
      - name: Deploy to Dev
        run: ./deploy.sh dev

  deploy-staging:
    if: github.ref == 'refs/heads/main'
    runs-on: ubuntu-latest
    environment: staging
    steps:
      - uses: actions/checkout@v3
      - name: Deploy to Staging
        run: ./deploy.sh staging

  deploy-production:
    if: github.ref == 'refs/heads/main'
    needs: deploy-staging
    runs-on: ubuntu-latest
    environment: production
    # Requires manual approval (configured in GitHub)
    steps:
      - uses: actions/checkout@v3
      - name: Deploy to Production
        run: ./deploy.sh production

trigger:
  branches:
    include:
    - main

pool:
  vmImage: 'ubuntu-latest'

variables:
  buildConfiguration: 'Release'

stages:
- stage: Build
  jobs:
  - job: BuildJob
    steps:
    - task: DotNetCoreCLI@2
      displayName: 'Restore dependencies'
      inputs:
        command: 'restore'

    - task: DotNetCoreCLI@2
      displayName: 'Build project'
      inputs:
        command: 'build'
        arguments: '--configuration $(buildConfiguration)'

    - task: DotNetCoreCLI@2
      displayName: 'Run tests'
      inputs:
        command: 'test'
        arguments: '--configuration $(buildConfiguration)'

    - task: DotNetCoreCLI@2
      displayName: 'Publish'
      inputs:
        command: 'publish'
        publishWebProjects: true
        arguments: '--configuration $(buildConfiguration) --output $(Build.ArtifactStagingDirectory)'

    - publish: $(Build.ArtifactStagingDirectory)
      artifact: drop

- stage: Deploy
  dependsOn: Build
  condition: succeeded()
  jobs:
  - deployment: DeployWeb
    environment: 'production'
    strategy:
      runOnce:
        deploy:
          steps:
          - task: AzureWebApp@1
            displayName: 'Deploy to Azure Web App'
            inputs:
              azureSubscription: 'Azure-Connection'
              appName: 'mywebapp'
              package: '$(Pipeline.Workspace)/drop/**/*.zip'

// main.bicep
param location string = resourceGroup().location
param environmentName string = 'prod'

resource appServicePlan 'Microsoft.Web/serverfarms@2022-03-01' = {
  name: 'plan-${environmentName}'
  location: location
  sku: {
    name: 'P1v2'
    tier: 'PremiumV2'
  }
}

resource webApp 'Microsoft.Web/sites@2022-03-01' = {
  name: 'webapp-${environmentName}-${uniqueString(resourceGroup().id)}'
  location: location
  properties: {
    serverFarmId: appServicePlan.id
    siteConfig: {
      alwaysOn: true
      ftpsState: 'Disabled'
      minTlsVersion: '1.2'
    }
  }
  identity: {
    type: 'SystemAssigned'
  }
}

output webAppName string = webApp.name

az deployment group create \
  --resource-group rg-prod \
  --template-file main.bicep \
  --parameters environmentName=prod

# Deploy new version to staging slot
az webapp deployment source config-zip \
  --resource-group rg-prod \
  --name myapp \
  --slot staging \
  --src app.zip

# Warm up the staging slot
curl https://myapp-staging.azurewebsites.net/health

# Instant swap to production (zero downtime)
az webapp deployment slot swap \
  --resource-group rg-prod \
  --name myapp \
  --slot staging \
  --target-slot production

# canary.yaml
apiVersion: flagger.app/v1beta1
kind: Canary
metadata:
  name: myapp
spec:
  targetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: myapp
  service:
    port: 80
  analysis:
    interval: 1m
    threshold: 5
    maxWeight: 50
    stepWeight: 10
    metrics:
    - name: request-success-rate
      thresholdRange:
        min: 99
      interval: 1m
    - name: request-duration
      thresholdRange:
        max: 500
      interval: 1m

# Add new backend pool with 10% weight
az network front-door routing-rule update \
  --front-door-name myfd \
  --name default-rule \
  --backend-pool pool-v1 \
  --backend-pool pool-v2 \
  --weight-v1 90 \
  --weight-v2 10

apiVersion: apps/v1
kind: Deployment
metadata:
  name: myapp
spec:
  replicas: 10
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1    # Never have more than 1 pod down
      maxSurge: 2          # Create 2 extra pods during update
  template:
    spec:
      containers:
      - name: app
        image: myapp:v2
        readinessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 5
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10

# Instant rollback to previous version
kubectl rollout undo deployment/myapp

# Rollback to specific revision
kubectl rollout undo deployment/myapp --to-revision=3

// Startup.cs
services.AddAzureAppConfiguration(options =>
{
    options
        .Connect(connectionString)
        .UseFeatureFlags(flags =>
        {
            flags.CacheExpirationInterval = TimeSpan.FromMinutes(5);
        });
});

// Controller.cs
[FeatureGate("NewCheckoutFlow")]
public IActionResult Checkout()
{
    return View("NewCheckout");
}

// If feature flag is OFF, this endpoint returns 404

{
  "id": "NewCheckoutFlow",
  "enabled": true,
  "conditions": {
    "client_filters": [
      {
        "name": "Microsoft.Percentage",
        "parameters": {
          "Value": 20
        }
      },
      {
        "name": "Microsoft.Targeting",
        "parameters": {
          "Audience": {
            "Users": ["user@example.com"],
            "Groups": ["beta-testers"],
            "DefaultRolloutPercentage": 20
          }
        }
      }
    ]
  }
}