End-to-End Developer Workflow

A modern Azure developer workflow connects source control, CI/CD, container infrastructure, and observability into a seamless inner loop from code commit to observable production. The key components are: GitHub (source), GitHub Actions (build and deploy pipeline), Azure Container Registry (image store), Azure Container Apps (runtime), and Application Insights (observability). Each change moves automatically from developer laptop to production within minutes, with quality gates at every step.

Organise your code in a GitHub repository using a trunk-based development or GitFlow branching strategy. For most microservices, trunk-based development (short-lived feature branches merged to main daily) reduces integration conflicts and keeps the pipeline simple. Use branch protection rules on main to require pull request reviews and passing CI checks before merging. A CODEOWNERS file ensures changes to critical services require approval from the relevant team's senior engineers.

The CI pipeline runs on every pull request. A typical workflow: checkout code → restore dependencies → run unit tests → run integration tests → build Docker image → push to Azure Container Registry. The image is tagged with the git commit SHA for traceability. Use OIDC-based authentication from GitHub Actions to Azure (via federated identity) to avoid storing Azure service principal secrets in GitHub — a managed identity equivalent for CI pipelines.

After the CI pipeline succeeds on a merge to main, the CD pipeline automatically deploys to the staging environment. The pipeline updates the Container App's image tag to the newly built SHA, waits for the new revision to become healthy, and runs smoke tests against the staging URL. Smoke tests verify that critical API endpoints return the expected responses. If smoke tests fail, the pipeline rolls back by switching ingress traffic back to the previous revision without any manual intervention.

After staging validation, the CD pipeline pauses at an approval gate. GitHub Actions Environment protections allow you to configure required reviewers for the production environment. The pipeline sends a Slack notification to the on-call engineer who reviews the staging test results, the diff, and any open incidents before approving. Only on approval does the pipeline proceed to deploy the same image SHA to production. This human-in-the-loop step is critical for high-traffic or regulated services.

Once deployed to production, Application Insights provides real-time visibility. The App Insights SDK (or auto-instrumentation for supported runtimes) tracks: request rates, failure rates, and latency (the three golden signals), dependency calls (to databases, Service Bus, other APIs), and exceptions with full stack traces. The Application Map visualises how services call each other and highlights which dependencies contribute the most to failures or latency.

Use Application Insights Annotations to mark deployment events in your metrics charts. When a release annotation is created (via the GitHub Actions azure/appinsights-annotation action), it appears as a vertical line on all App Insights metric charts. This makes it immediately obvious whether a latency spike or error rate increase correlates with a recent deployment, significantly reducing mean-time-to-diagnose (MTTD) during incidents.

For the most resilient pipelines, implement automated rollback. After production deployment, the pipeline waits 10 minutes and queries Application Insights for the error rate. If the error rate exceeds a configurable threshold (e.g., >5%), the pipeline automatically rolls back by updating the Container App's ingress traffic to point 100% to the previous revision. This progressive delivery pattern reduces the blast radius of a bad deployment and allows teams to deploy with confidence even for complex or sensitive changes.

Developers should be able to run and test the full stack locally without connecting to production Azure resources. Use Azure Storage Emulator (Azurite) for local blob and queue storage, Cosmos DB Emulator for local database testing, and Service Bus Emulator for local messaging. The AZURE_ENVIRONMENT=local environment variable can switch DefaultAzureCredential to use connection strings pointing at emulators, while the same code uses managed identity in Azure. Docker Compose orchestrates all local dependencies in a single docker compose up.

Integrate security into every stage of the developer workflow: Dependabot scans for vulnerable dependencies in pull requests; GitHub Advanced Security (code scanning with CodeQL) detects vulnerabilities like SQL injection and hardcoded secrets; Microsoft Defender for DevOps integrates with GitHub to surface Azure security recommendations alongside code changes; and ACR Defender vulnerability scanning checks container images for OS and application-layer CVEs after every push. Security findings appear as pull request comments, so they are addressed before merging.

The complete developer workflow is a continuous feedback loop: a developer commits code, CI builds and tests the container image, the image is pushed to ACR with the commit SHA as tag, CD deploys to staging and runs smoke tests, a human approves the production deployment, the pipeline deploys to production and creates a release annotation, and Application Insights monitors error rates with automated rollback if thresholds are breached. Infrastructure as code (Bicep or Terraform) in the same repository ensures the pipeline, Container App, and monitoring configuration are all version-controlled alongside application code.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: the end-to-end developer workflow connects GitHub source control, GitHub Actions CI/CD, Azure Container Registry, Container Apps, and Application Insights, release annotations correlate deployments with metric changes for faster incident diagnosis, and automated rollback based on error rate queries reduces blast radius from bad deployments. Next up we shift to exam preparation with a comprehensive review of cloud concepts and Azure architecture.