What are your best practices in migrating profiles and permission sets? I have been trying to migrate them from one org to another org. However it is not working. Do you have to move the entire code base at once to migrate the profiles. Please advise.
Moving profile depends on difference of profile in Sandbox and the production.
If you are doing with continuous integration process then you can move profile by changeset.
To move profile with changeset you must have source profile same as target organisation and added new permissions and modified permissions. If there is some permission which is missing in source profile then there can be chances of unexpected behaviour. Login IP ranges, FLS can be reset by doing this. So, carefully examine permissions then deploy.
It is always preferred to make those changes live manually in production instead of changeset. It is difficult to know which access changed.
Profile permissions always need to be examined. Each component in organisation is part of Profile whether it is class or vf or a field.
A profile moved in other environment must have accessibility setting for all components for all component exist in target environment.
For permission sets, it's pretty easy to move them using dataloader.
This article might be of use: https://help.salesforce.com/articleView?id=000322112&language=en_US&type=1&mode=1
Migrating profile/perm sets is an endeavor on its own. Technically you can create a package.xml with required profile/permsets names and corresponding entities (if you are migrating field perms the include those fields) and deploy that full package to target org.
That you can accomplish using any of the metadata migration based tools like workbench/ant migration/realfire and others.
Another way is to use profile comparison tools which compares the profiles/perm sets for required entities, and lets you copy over the perms.
Realfire provides profile/perm sets comparison feature which allows you visualize, copy permissions across connections, and save them. This process provides most easiest approach but if you have CI/CD, you will have to refresh that backup of metadata after making changes as you will be making changes to access in target org directly.
[Disclaimer: I'm part of the team that builds Realfire]