CI/CD

Continuous Integration & Deployment — Azure · AWS · GCP

Concept

CI/CD pipelines automate build, test, and deployment. Each cloud offers managed CI/CD services that integrate with their native compute and artifact registries.

Managed CI/CD

Azure DevOps / GitHub Actions

CodePipeline + CodeBuild + CodeDeploy

Cloud Build + Cloud Deploy

Artifact Registry

Azure Container Registry (ACR)

ECR (Elastic Container Registry)

Artifact Registry (Docker, Maven, npm, Python, Helm)

Deploy Targets

AKS, App Service, Container Apps

EKS, ECS, Lambda, EC2

GKE, Cloud Run, Cloud Functions, App Engine

Secrets Mgmt

Azure Key Vault

Secrets Manager / SSM

Secret Manager

Approval Gates

Environments + Approvals

Manual Approval Action

Cloud Deploy Approval Promotion

Azure DevOps Pipeline (YAML)

trigger:
  branches:
    include: [main]
pool: ubuntu-latest

stages:
- stage: Build
  jobs:
  - job: BuildAndPush
    steps:
    - task: Docker@2
      inputs:
        containerRegistry: my-acr
        repository: platform/payments
        tags: $(Build.BuildId)
- stage: Deploy
  jobs:
  - deployment: DeployToProd
    environment: prod
    steps:
    - task: HelmDeploy@0
      inputs:
        command: upgrade
        chartPath: $(Pipeline.Workspace)/helm
        releaseName: payments-release
        namespace: prod

GCP Cloud Build (cloudbuild.yaml)

steps:
- name: gcr.io/cloud-builders/docker
  args: [build, -t, us-central1-docker.pkg.dev/$PROJECT_ID/repo/payments:$SHORT_SHA, .]
- name: gcr.io/cloud-builders/docker
  args: [push, us-central1-docker.pkg.dev/$PROJECT_ID/repo/payments:$SHORT_SHA]
- name: gcr.io/google.com/cloudsdktool/cloud-sdk
  entrypoint: bash
  args:
  - -c
  - |
    gcloud container clusters get-credentials my-cluster --region us-central1
    helm upgrade payments-release ./helm/payments -n prod --set image.tag=$SHORT_SHA
images:
- us-central1-docker.pkg.dev/$PROJECT_ID/repo/payments:$SHORT_SHA

GitHub Actions (Cloud-Agnostic via WIF)

name: Build & Deploy
on:
  push:
    branches: [main]

jobs:
  build-deploy:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
    - uses: actions/checkout@v4
    - uses: google-github-actions/auth@v2
      with:
        workload_identity_provider: ${{ vars.WIF_PROVIDER }}
        service_account: ${{ vars.CICD_SA }}
    - run: |
        docker build -t $REGISTRY/payments:$GITHUB_SHA .
        docker push $REGISTRY/payments:$GITHUB_SHA
    - run: |
        gcloud container clusters get-credentials $CLUSTER --region $REGION
        helm upgrade payments-release ./helm -n prod --set image.tag=$GITHUB_SHA