Continuous integration proves a change can become a trustworthy artifact. Continuous delivery promotes that immutable artifact through environments with policy and evidence. GitHub Actions and Azure Pipelines can both deploy Azure; choose by organization, repository, governance, marketplace, and operating model—not by YAML syntax alone.
Method note: This chapter compares pipeline operating models, authentication, evidence, and release gates rather than pretending YAML fragments are interchangeable. Concrete GitHub Actions and Azure Pipelines setup remains visible in sequence so their different identity and governance prerequisites are clear.
Build once. Promote the same image/package digest. A production rebuild creates an untested artifact.
Use OpenID Connect workload identity federation. The CI platform issues a short-lived identity token; Entra trusts a specific repository/branch/environment or Azure DevOps service connection. No client secret is stored.
Grant separate identities per environment. The pull-request identity can validate and plan, while the protected production environment identity can deploy only after approval. Scope roles to the required subscription/resource group/resources.
IDs are environment configuration rather than passwords, but keep repository variables and scopes controlled. Pin third-party actions to reviewed immutable commits under high-assurance policy.
Azure Repos, Pipelines, Artifacts, Boards, Test Plans, and environment checks integrate with Entra and Azure. Use an Azure Resource Manager service connection configured for workload identity federation. Protect environments with approvals, branch control, required templates, and exclusive locks when needed.
Reusable YAML templates should enforce scanning, artifact publication, IaC preview, evidence, and deployment conventions. Product pipelines pass narrow parameters rather than copying security-critical steps.
Infrastructure changes produce endpoints and identities; application deployment consumes non-secret outputs. Avoid a single job with subscription Owner that creates everything and ships arbitrary code. Separate duties and permissions:
Do not make a vulnerability scanner's “zero findings” the only release definition. Define severity, exploitability, exceptions, owner, expiry, and compensating controls.
Rollback application traffic to the previous healthy slot/revision/image digest. Roll forward infrastructure/data when destructive rollback is unsafe. Use backward-compatible database migrations. Keep feature flags separate from deployment and test the kill switch.