ssdt-cicd-best-practices-2025

No direct malware or deliberate data theft is evident in the supplied pipelines. The configuration has significant supply-chain and operational security concerns: an unpinned third-party GitHub Action, trusted self-hosted runners using integrated authentication, unverified DACPAC artifacts, and a development deployment that can delete objects while allowing possible data loss. Pin third-party actions to immutable SHAs, harden and isolate runners, use scoped service identities, verify artifact provenance, publish and retain deployment reports, and require explicit review for destructive settings.