Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
YouTube Security VideosAndroid Police: Samsung is smashing records! #shorts #tech #phones(21.09.2026 um 13:55 Uhr)
YouTube Security Videosheise & c't: Bundesnetzagentur wollte diesen Futterautomaten verbieten(21.09.2026 um 13:53 Uhr)
YouTube Security VideosNeil Patel: Your Google Traffic Isn't An Asset It's A Loan #shorts(21.09.2026 um 14:05 Uhr)
Windows Tipps & SecurityF-14 A Tomcat Top Gun endlich als Revell Klemmbausteinmodell erhältlich(21.09.2026 um 14:27 Uhr)
Sichere ProgrammierungShow the Hand-Back Sample Before Approving an Agent Score(21.09.2026 um 14:15 Uhr)
Sichere ProgrammierungHybrid retrieval in one Postgres query: RRF over tsvector + pgvector(21.09.2026 um 14:15 Uhr)
YouTube Security VideosAndroid Police: Samsung is smashing records! #shorts #tech #phones(21.09.2026 um 13:55 Uhr)
YouTube Security Videosheise & c't: Bundesnetzagentur wollte diesen Futterautomaten verbieten(21.09.2026 um 13:53 Uhr)
YouTube Security VideosNeil Patel: Your Google Traffic Isn't An Asset It's A Loan #shorts(21.09.2026 um 14:05 Uhr)
Windows Tipps & SecurityF-14 A Tomcat Top Gun endlich als Revell Klemmbausteinmodell erhältlich(21.09.2026 um 14:27 Uhr)
Sichere ProgrammierungShow the Hand-Back Sample Before Approving an Agent Score(21.09.2026 um 14:15 Uhr)
Sichere ProgrammierungHybrid retrieval in one Postgres query: RRF over tsvector + pgvector(21.09.2026 um 14:15 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

Streamlining Deployment: How GitHub Releases Elevate Your Engineering KPIs and Development OKRs

In the fast-paced world of software development, efficient and well-documented deployment processes are not just a nice-to-have; they are crucial for team productivity, successful rollbacks, and ultimately, achieving your development OKR…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

In the fast-paced world of software development, efficient and well-documented deployment processes are not just a nice-to-have; they are crucial for team productivity, successful rollbacks, and ultimately, achieving your development OKR examples. A recent discussion in the GitHub Community highlighted a common point of confusion that many teams face: the precise role of softprops/action-gh-release in a deployment workflow and its interaction with server directories. Clarifying this distinction is key to unlocking more robust practices that can directly support your strategic goals for release quality and deployment efficiency.






The Challenge: When Old Habits Become Roadblocks to Progress



Rod-at-DOH initiated the GitHub discussion, painting a familiar picture of an entrenched, manual deployment habit within his team. Their process, rooted in legacy Visual Studio Publish workflows, involved:




  • Creating a new folder with the current date and developer initials (e.g., "2026-427 rf").


  • Moving all code from a "current" folder into this newly created, ambiguously named backup folder.


  • Deploying new code into the now-empty "current" folder.




This approach, while perhaps well-intentioned as a rudimentary backup strategy, quickly devolved into a nightmare. Imagine a server littered with 30 to 100 folders like "2026-427 rf"—none of which clearly indicate their contents. When the pressure mounted for a rollback, developers were forced to sift through dozens of these opaque directories, guessing which one might contain a stable, appropriate version. This isn't just inefficient; it's a significant drain on developer time and a major risk to delivery timelines, directly impacting your team's ability to hit critical engineering KPIs related to uptime and mean time to recovery.



Rod recognized the superior documentation capabilities inherent in GitHub's Release functionality, where releases can be clearly described, and sought to integrate softprops/action-gh-release into their GitHub Workflow. His primary concern, a valid one given the existing chaos, was whether this action would inadvertently delete the existing "current" folder and the numerous backup directories on their self-hosted Windows runner.






Rod-at-DOH's Workflow Snippet:




  • name: Run Action-GH-Release
    uses: softprops/action-gh-release@v2
    with:
    tag_name: v${{ steps.tagger.outputs.version }}
    name: Release v${{ steps.tagger.outputs.version }}
    body: ${{ github.event.pull_request.body }}






Demystifying softprops/action-gh-release: Release vs. Deployment



The short answer, provided by community member Gitious, was a resounding "no." softprops/action-gh-release will not wipe out your current folder or any of the dated backup folders. This clarification is critical for understanding modern CI/CD pipelines.



The confusion often stems from conflating "GitHub Release" with "web application deployment." They are, in fact, two distinct steps with different purposes:



GitHub Release: This is primarily a documentation and artifact storage mechanism on github.com. When you use softprops/action-gh-release, it performs the following actions:




  - Creates a GitHub Release entry under your repository's "Releases" tab.

- Creates a Git tag (if it doesn't already exist) corresponding to the release version.

- If configured with a `files:` input, it uploads specified files (e.g., your compiled application, a zipped artifact) as downloadable assets attached to that Release.



Crucially, this action operates entirely within the GitHub ecosystem and the workflow's temporary workspace. It has no concept of, nor does it interact with, your server's persistent filesystem outside of the workflow's own working directory.






  • Web Application Deployment: This is the actual process of copying your application's build artifacts from your CI/CD environment to your production (or staging) server's designated directory (e.g., your "current" folder). This step typically involves tools like robocopy, msdeploy, or specialized deployment actions that are designed to interact with your server's filesystem.



Understanding this separation is fundamental for building reliable and transparent deployment pipelines that contribute positively to your development OKR examples and overall team efficiency.



Visual breakdown of a robust deployment pipeline: Build & Package, Create GitHub Release, and Deploy to Server as separate, sequential steps.Visual breakdown of a robust deployment pipeline: Build & Package, Create GitHub Release, and Deploy to Server as separate, sequential steps.






Building a Robust Deployment Pipeline: The Recommended Pattern



Instead of a single, monolithic "publish" step, a genuinely better pattern for modern web application deployment involves a clear separation of concerns:



Build and Package Your Application:

Your workflow first compiles and packages your application. For .NET applications, this might be a dotnet publish command, outputting files to a designated folder within your workflow's workspace. For other stacks, it could involve webpack, npm build, or similar commands. It's often beneficial to then zip these publish outputs into a single artifact.



Create a GitHub Release with Artifacts:

This is where softprops/action-gh-release shines. After building, use this action to create a new GitHub Release. Make sure to include the files: input, pointing it to your zipped application artifact. This step ensures that every release is documented with a human-readable name, a body explaining what shipped (often derived from PR descriptions or commit messages), and a downloadable, immutable artifact of exactly what was deployed. This significantly improves traceability and provides concrete data for your engineering KPIs related to release quality and auditability.




- name: Build and package app




run: |

dotnet publish -c Release -o ./publish

zip -r app-release.zip ./publish




  • name: Create GitHub Release
    uses: softprops/action-gh-release@v2
    with:
    tag_name: v${{ steps.tagger.outputs.version }}
    name: Release v${{ steps.tagger.outputs.version }}
    body: ${{ github.event.pull_request.body }}
    files: app-release.zip # <-- Crucial for attaching the artifact
    # ... other inputs



Deploy to Your Server:

As a separate step, use a dedicated deployment mechanism to copy the build artifacts to your server's target directory (e.g., the "current" folder). This could be robocopy, msdeploy, an IIS-specific action, or even an SSH-based deployment for Linux servers. This is the step that actually touches your server's filesystem and replaces the contents of "current."




- name: Deploy to Server




run: |

# Example for Windows self-hosted runner

# Assuming 'current' is a directory on the server

robocopy ${{ github.workspace }}/publish D:\inetpub\wwwroot\YourApp\current /MIR /XD "2026-427 rf" # /XD to exclude old backup folders

# Or use a dedicated deployment tool/action






The Power of Documentation and Streamlined Rollbacks



This structured approach offers immense benefits, particularly for the rollback scenario Rod-at-DOH described. Instead of guessing which "2026-427 rf" folder was the good one, your team now has:




  • Clear Documentation: Each GitHub Release has a human-readable name, a detailed body explaining its contents, and a direct link to the associated PR or commits. This clarity significantly enhances your sprint review meeting agenda discussions, allowing stakeholders to easily understand what was delivered.


  • Reliable Artifacts: The attached zip file is an immutable snapshot of exactly what was released. To roll back, you simply download the desired older release artifact from GitHub and run your dedicated deploy step against it. No more guesswork, no more "poor guy" under pressure sifting through dozens of folders.


  • Improved Auditability: Every deployment is tied to a specific, documented release, making it easier to track changes, debug issues, and meet compliance requirements. This directly contributes to better engineering KPIs related to release success rate and compliance.







Practical Considerations for Implementation



To ensure your new pipeline is successful, keep these practical notes in mind:




  • Permissions: Your workflow job must have permissions: contents: write to allow softprops/action-gh-release to create the release and push the tag.


  • Attach Files: Always use the files: input to attach your build artifacts to the GitHub Release. Without it, the release will be created with no assets, and your rollback story loses its teeth.


  • Testing: Verify your setup safely by running it on a test repository or with a throwaway tag. Observe your runner's working directory and your target server's "current" folder side-by-side to confirm the expected behavior.







Elevating Your Delivery with Clear Processes



Moving away from legacy, manual deployment habits towards a clear, automated CI/CD pipeline with distinct release and deployment steps is a significant leap forward. It's not just about using a new tool; it's about adopting a philosophy that prioritizes clarity, traceability, and reliability. By embracing patterns like those enabled by softprops/action-gh-release, you empower your development teams, streamline your operations, and directly contribute to achieving your strategic development OKR examples focused on delivery excellence and operational efficiency. This is how technical leadership translates into tangible productivity gains and a more confident, capable engineering organization.

Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Streamlining Deployment: How GitHub Releases Elevate Your Engineering KPIs and Development OKRs

Thematisch verwandte Begriffe: Streamlining, Deployment, GitHub, Releases · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-94097 | A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. Th…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick