How would you describe a good CI/CD pipeline for a .NET backend or full-stack application?

I design pipelines around risk and evidence. Fast deterministic checks protect pull requests, while the release path produces one immutable artifact, records its source and dependencies, verifies environment configuration, and promotes that artifact without rebuilding. Database migrations, security-sensitive changes, and public contracts receive targeted gates. Deployment uses least-privilege identity, staged exposure where useful, automated smoke checks, and user-facing health metrics. A failed stage preserves logs, test results, and artifact identity for diagnosis. Recovery is part of the pipeline contract: rollback, roll-forward, or feature disablement has an owner, compatibility constraints, and a verified path rather than a manual guess during an incident.