Built GitHub Actions CI/CD pipelines with a distroless production frontend image and multi‑environment promotion.

Situation. Shipping shouldn’t depend on someone remembering the steps, and what ends up running in production shouldn’t be a fat general‑purpose container carrying a shell and a package manager it’ll never use — that’s just attack surface sitting there for no reason.

Task. Make the path from commit to running‑in‑Azure automatic, and keep the production images as small and locked‑down as each workload allows.

Action. The pipeline is GitHub Actions. Separate workflows handle the code‑quality gate, the tests, and the per‑environment deploys, with CodeQL, dependency review and an SBOM step alongside them, so nothing reaches an environment without passing the checks first. The images are multi‑stage builds, and the base for each part was picked on its merits rather than as one blanket choice: the frontend ships on a distroless image (gcr.io/distroless/cc‑debian13 — no shell, no package manager), the Go API on a slim Alpine, and the database image on postgres‑slim. Promotion moves a build through the environments along a defined route rather than by hand.

Result. Releases stopped being a careful manual ritual and became a routine, boring event, which is exactly what you want from releases. The production frontend runs on about as little as you can give it, the checks catch problems before they land, and “deploy” is something the pipeline does rather than something anyone sweats through.