Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
CI, Continuous Delivery and Continuous Deployment: The Differences and Why They Matter
CI means everyone integrates into the mainline every day and every push runs an automated build and tests; continuous delivery keeps every commit releasable and leaves going to production as a decision, while continuous deployment removes that button too. An integration hell scenario, Fowler's 2024 practices, a CI workflow run with act, and the MinimumCD checklist.
Pipeline Anatomy: Triggers, Stages, Jobs, Steps and Failing Fast
A pipeline starts with triggers and is made of dependent jobs (stages in Jenkins) and steps that run in order; putting the build logic in a script that runs locally, letting the pipeline only orchestrate, moving cheap checks first and failing fast across parallel branches all speed up feedback. A GitHub Actions, Jenkins and Azure DevOps term mapping, with real output from act and Jenkins.
Build Once, Deploy Many: Artifacts, Versioning and Immutable Packages
Building an artifact once and carrying that same artifact, by tag or digest, from staging to production guarantees that what was tested on staging is what reaches production; even building the same commit twice yields different images. Reproducible builds with lock files and npm ci, stamping versions with the commit SHA, the :latest trap, and a runtime config.json for Angular.
Testing in the Pipeline: Fast Feedback, Quality Gates and Flaky Tests
Ordering tests in the pipeline from cheap to expensive (formatting, unit, integration with Testcontainers, e2e with Playwright) and adding quality gates such as warnings, coverage and bundle budgets gives fast, trustworthy feedback; a flaky test needs its root cause fixed rather than a retry. How a test without assertions inflates coverage, a real flaky test failing 2 of 30 runs, and an empty Playwright shard.
Environments and Promotion: Dev, Test, Staging, Production and Configuration
The same artifact moves through dev, test, staging and production without being rebuilt; the only thing that should change from step to step is configuration coming from the environment. Layered configuration in ASP.NET Core with appsettings.{Environment}.json and environment variables, a missing setting that fails at startup with ValidateOnStart, a difference inventory between staging and production, preview environments per PR, and masking non-prod data.
Approvals, Gates and Deployment Controls: Adding People and Rules to a Pipeline
Automated gates (smoke tests, health checks, deploy freezes) should answer 'does this change work?', while a manual approval should answer 'now?'; DORA found no evidence that heavyweight external approvals lower the change fail rate. Real output showing that a Jenkins input step's submitter does nothing when everyone is an administrator, GitHub environment protection rules and Azure DevOps checks.
Pipeline Security and Secrets: Least Privilege, Short-Lived Credentials and Supply Chain
The pipeline is the most powerful user, holding production keys; keeping secrets in a store, least privilege per job, short-lived tokens via OIDC instead of long-lived cloud keys and pinning actions to commit SHAs close most of the risk. Real act output showing a base64-encoded secret escaping masking, script injection caught by actionlint, fork PR risks, and a short look at SLSA v1.2 and SBOMs.
Measuring and Speeding Up a Pipeline: DORA Metrics, Caching and Parallelism
DORA's current five metrics (change lead time, deployment frequency, failed deployment recovery time, change fail rate, deployment rework rate) are calculated from deploy records and should be tracked as team-level trends; speeding up a pipeline starts with measuring. A single-file C# calculator, a real act measurement where a NuGet cache saved only 0.2 seconds of restore at a 2.3-second restore cost, cache key design, and the path filter trap.