CI/CD deployment workflow

Deployment should be controlled

A deployment workflow should build a known version, run required checks and deploy only when the project's release policy allows it.

Use environments for sensitive deployments

GitHub environments can associate deployment protection rules and environment-specific secrets with a deployment target. This helps separate development, staging and production concerns.

Build once when possible

For reliable delivery, create a verified artifact and promote that artifact through environments rather than rebuilding different source states for each environment.