The Deployment Pipeline That Pays for Itself
Manual deployments are a tax. Every manual step is a potential error, a context switch, and a reason deployments slow down as the team grows. CI/CD pipelines convert that tax into a fixed one-time investment.
This is the GitHub Actions pipeline we use for deploying Next.js + FastAPI applications to Azure App Service — with secrets managed via Azure Key Vault, environment configuration via GitHub Environments, and zero-downtime slot swaps.
The Overall Pipeline Structure
The key design decision: separate jobs for test, build, staging deploy, and production deploy — each requiring the previous to succeed, with manual approval gates on production.
Authentication: OIDC Instead of Service Principal Secrets
The old pattern — create a service principal, store the JSON credentials as a GitHub secret — works but requires rotating secrets and gives broad access. The modern pattern usesOpenID Connect (OIDC) to mint short-lived tokens on demand with no stored secrets.
Azure configuration (one-time setup):
Building and Pushing to Azure Container Registry
The
cache-from: type=gha lines enable GitHub Actions layer caching — Docker build times drop from 3–4 minutes to 30–45 seconds on warm cache.Zero-Downtime Deployment with Slot Swaps
Azure App Service deployment slots let you deploy to a staging slot, warm it up, then swap it into production atomically:
Environment Variables and Secrets Strategy
Never put secrets in YAML files. The hierarchy:
Non-sensitive configuration → App Service Application Settings:
Secrets → Azure Key Vault references:
Key Vault references auto-rotate: when the secret value changes in Key Vault, App Service picks up the new value on the next restart without any pipeline changes.
The Complete Picture
From
git push to production-ready container: 4–6 minutes. From manual approval to live traffic: 2 minutes. Rollback (swap back): 90 seconds.