Shipping .NET with Docker and GitHub Actions

Build once, promote everywhere

The cardinal rule of a deployment pipeline is that the artefact you tested is the artefact you ship. Everything below follows from it.

The Dockerfile

FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
WORKDIR /src
COPY . .
RUN dotnet publish source/TechieBlog/TechieBlog.csproj -c Release -o /app

FROM mcr.microsoft.com/dotnet/aspnet:10.0
WORKDIR /app
COPY --from=build /app .
ENTRYPOINT ["dotnet", "TechieBlog.dll"]

The workflow

name: build
on:
  push:
    branches: [ main ]

jobs:
  container:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: docker build -t techieblog:${{ github.sha }} .
      - run: docker run --rm techieblog:${{ github.sha }} --version

Things worth doing early

1. Tag images with the commit SHA, never with latest.
2. Run migrations from the application at startup, so a rollback of the image is a rollback of the schema expectation too.
3. Keep secrets in the platform's secret store; a connection string in an environment file will eventually be committed.
4. Fail the build on a failing smoke test, not on a warning count.

A pipeline nobody trusts gets bypassed. Make it fast enough that bypassing it is never tempting.