← Back to Insights
/ Engineering Insights

A walkthrough of how I automate build, test, and release pipelines for microservices and APIs

A poorly designed pipeline is a hidden tax on every deployment. Here's the exact structure I use to automate build, test, and release pipelines for microservices on Azure DevOps — and the mistakes I stopped making.

A walkthrough of how I automate build, test, and release pipelines for microservices and APIs
Emile Ndagijimana
Emile Ndagijimana
June 20, 2026
/
DevOps & Delivery

Why most microservice pipelines are too fragile

When a system has ten microservices, the temptation is to copy-paste one pipeline YAML ten times and call it done. I did this. It breaks at scale — one template change has to be applied ten times, drift creeps in, and debugging a failed build means reading 400 lines of YAML you didn't intend to write.

Here's how I structure pipelines that scale cleanly across services on Azure DevOps.

The structure: shared templates, per-service triggers

The key insight is separating the what (pipeline logic) from the which (service config). One shared template library. Thin per-service pipeline files that point to it.

Stage 1 — Build

Every microservice pipeline triggers on its own source path using Azure DevOps path filters. The build stage runs dotnet build, caches NuGet packages by lock file hash, and produces a versioned artifact. Versioning follows a semantic convention based on branch name and build number — no manual tagging required.

Stage 2 — Test

Unit tests and integration tests run as parallel jobs. Unit tests run first, fast, with zero external dependencies. Integration tests spin up Docker service containers (SQL Server, Redis) directly in the pipeline. If unit tests fail, integration tests don't start — fast feedback, no wasted minutes.

Code coverage is collected via Coverlet and published to Azure DevOps test analytics. A coverage gate blocks the pipeline if it drops below threshold.

Stage 3 — Release

The release stage builds a Docker image, pushes to Azure Container Registry, and triggers a rolling deployment to AKS via Helm. Environment-specific values — connection strings, feature flags, secrets — are injected from Azure Key Vault at deployment time. Never hardcoded in YAML, never committed to the repo.

The mistake that cost me two production incidents

Early on, I let the release stage run automatically on every merge to main — including for services that hadn't changed. A broken shared library would cascade and trigger simultaneous rollouts across all services.

The fix: change detection. Each pipeline checks whether the service's source path changed since the last successful run. Unchanged services are skipped entirely. Deployment blast radius drops from "everything" to "exactly what changed."

"A pipeline should deploy the minimum necessary to reflect what changed — not everything that could possibly need updating."

What I'd add if starting fresh today

Drift detection from day one — a nightly pipeline that checks whether the deployed image SHA matches the expected artifact version. Silent drift in long-running containers is more common than you'd expect, and catching it proactively beats discovering it during an incident at 2am.

/ My SaaS

I write about building Contractly Pro

Real decisions, real tradeoffs, real architecture — from solo founder to production SaaS. Read the Founder Journal or try the app.

Explore our collection of 200+ Premium Webflow Templates

Need to customize this template? Hire our Webflow team!