Shipping: builds, environments and health checks

Getting code safely from your machine to production: CI, configuration, secrets and a rollback plan.

UnderstandStudy an examplePractise

Understand the concept

Shipping should be a process that repeats the same way every time. Continuous integration (CI) builds the code in a clean environment on every push, runs type checks and lint, and executes tests. In this project GitHub Actions runs typecheck, lint, contract tests, a production build and Playwright end-to-end tests for the frontend, and the .NET build and security checks for the backend. A red CI means a problem was caught before reaching users.

The same build output runs with different configuration in different environments. Environment-specific values (API address, site address, connection strings, keys) go into environment variables, not code. In Next.js, variables prefixed NEXT_PUBLIC_ are embedded in the browser bundle, so secrets are never defined with that prefix.

Post-deployment verification is part of the process: is the health endpoint responding, did the error rate rise, do the key pages open? A backup is taken before database migrations are applied. When something goes wrong, the way back to the previous version must be known and rehearsed in advance.

WHEN TO USE IT

Manual releases done differently each time are the most frequent source of incidents.

COMMON PITFALL

Defining an API key with the NEXT_PUBLIC_ prefix and leaking it to the browser.

01 / PRACTICE

One topic. Three levels of depth.

Illustrative example

# frontend/.env.local (depoya girmez)
API_BASE_URL=http://127.0.0.1:5048   # yalnız sunucu
SITE_URL=https://ataberksahin.net
# NEXT_PUBLIC_ öneki YOK: tarayıcıya gömülmez

Server-only values have no prefix and never enter the browser bundle.

This page connects to no real server or database. Code samples are illustrative for .NET 8, Next.js and SQL Server; timings are example values in the simulation, not measurements. Try samples only in your own development environment; never share real connection strings, tokens or passwords.

02 / YOUR TURN

Try it yourself first.

A developer added a maps service key as NEXT_PUBLIC_MAPS_KEY. Is that a problem? When is it acceptable?

Show the solution and explanation

Worked solution

Değer tarayıcı paketine gömülür; herkes görebilir.
Kabul edilebilir: anahtar zaten istemcide kullanılmak üzere tasarlanmışsa
(alan adı/referrer kısıtlı, kota sınırlı, yalnız herkese açık işlemler).
Gizli anahtarlar sunucuda kalır ve istek bir route handler üzerinden yapılır.

NEXT_PUBLIC_ means ‘public’. Defining a value with that prefix is the same as publishing it.

RasimAtaberkŞahin

Understand the concept

One topic. Three levels of depth.

Try it yourself first.