IaC & Automation
CI/CD & GitHub Actions
Automated test suites, artifact packaging, and zero-downtime release pipelines.
Continuous Integration and Continuous Deployment (CI/CD) automates the delivery lifecycle from code push to production release. GitHub Actions coordinates ephemeral runners, caches dependencies, runs test matrices, builds OCI images, and deploys infrastructure.
Virtual Lab Ready
Automated testing sandbox running in your browser.
Launch First Lab ⚡No local installation required
Hands-on Practice
Interactive Terminal Labs
Real environment tasks with automated validation. Write real commands, verify state, and debug errors.
Write Your First GitHub Actions Workflow
Topic: Your First Pipeline
A pipeline is a file in the repository — that's the whole trick. Create the exact directory layout GitHub Actions expects and write a workflow that runs on every push.
Key Checks:
- File ~/project/.github/workflows/ci.yml exists
- Workflow triggers on push
Run Tests in the Pipeline
Topic: Jobs & Testing
A pipeline that only checks out code proves nothing. Extend the workflow so it installs dependencies and runs the test suite on every push.
Key Checks:
- The workflow runs on ubuntu-latest
- The workflow contains a test step running pytest
Build and Push a Docker Image in CI
Topic: Build & Push Images
The final pipeline stage for most services: build an image and publish it to a registry. Extend the workflow with Docker build and push steps.
Key Checks:
- The workflow logs in to the registry
- The workflow builds with docker/build-push-action
Guard the Deploy Secrets
Topic: Deployments & Secrets
A deploy workflow needs AWS credentials — and pasting them into the YAML is how leaks happen. Write a deploy workflow that reads its keys from GitHub Secrets, then record the secret inventory in a checklist file so the next engineer knows what exists and where it lives.
Key Checks:
- File ~/project/.github/workflows/deploy.yaml exists
- The workflow checks out the code and reads AWS_ACCESS_KEY_ID from GitHub Secrets
Add an Approval Gate to a Deployment
Topic: Release Pipelines
Production deployments should need a human. Extend a pipeline with a manual trigger and an environment that requires approval before anything ships.
Key Checks:
- Directory ~/ci exists
- File ~/ci/deploy.yml exists
Build a Version Matrix
Topic: Release Pipelines
One pipeline, many versions. Declare a matrix strategy so every job runs once per Python version and the matrix grows without editing the file.
Key Checks:
- Directory ~/ci exists
- File ~/ci/matrix.yml exists
System Design
Event-Driven Workflow Automation
Understand how this tool operates internally before running production workloads.
Internal Mechanics
GitHub triggers workflows based on webhook events (push, pull_request, schedule). Workflows contain one or more jobs running on isolated virtual machine runners executing declarative steps.
Mental Model Rule of Thumb
Never treat CI/CD & GitHub Actions as a black box. Understanding its boundary with the kernel, filesystem, and network stack prevents 90% of production outages.
Core Architectural Subsystems
Workflow Triggers (on:)
Defines event conditions that initiate pipeline execution.
Runners (GitHub-hosted / Self-hosted)
Ephemeral Linux/macOS/Windows VMs executing workflow steps.
Job Dependencies (needs:)
Constructs dependency graphs (e.g. test must pass before deploy runs).
Secrets & Environments
Encrypted credential store protected by approval gates and branch rules.
Developer Reference
Command Reference & Cheatsheet
Curated commands, flags, and one-liners tested for everyday operational productivity.
gh run list --limit 10List status of the 10 most recent workflow runs via GitHub CLI
gh run watch <run-id>Watch live progress of a running workflow execution in terminal
act -j testRun GitHub Actions workflows locally inside Docker using the 'act' tool
gh secret set AWS_ROLE_ARN --body 'arn:aws:iam::...'Set an encrypted repository secret from command line
Fundamental Primitives
Key Terminology & Primitives
Core abstractions you must master to communicate and build with confidence.
Matrix Builds
Running tests simultaneously across multiple OS types and language versions (e.g., Node 18, 20, 22 on Ubuntu/macOS).
Dependency Caching
Persisting node_modules or pip wheels between workflow runs via actions/cache to accelerate builds.
Artifact Passing
Uploading compiled binaries or test coverage reports in one job and downloading them in downstream jobs.
OIDC Federation
Authenticating directly to AWS/GCP without storing long-lived secret access keys in repository settings.
Production War-Stories
Common Pitfalls & Debugging Playbook
The exact errors that take down production systems and how to diagnose and resolve them.
Secret not available in pull_request from fork
Symptom
Workflow fails with empty environment variable.
Resolution
GitHub masks secrets on pull_request from forks for security reasons. Use pull_request_target with strict verification if necessary.
Slow builds due to cache misses
Symptom
Every workflow run spends 5+ minutes redownloading dependencies.
Resolution
Verify hashFiles('**/package-lock.json') key pattern and ensure cache path matches package manager directory.
Reliability Standards
Production Readiness Checklist
Review this checklist before deploying workloads to staging or production clusters.
- ✓Pin third-party Actions to exact commit SHAs rather than mutable tags like @v3.
- ✓Use OpenID Connect (OIDC) instead of static cloud credentials.
- ✓Set minimal permissions in the workflow permissions: block.
- ✓Enforce branch protection requiring CI checks to pass before merging.
- ✓Set job timeouts to avoid runaway bills from stuck processes.
Full Curriculum Track
Master CI/CD & GitHub Actions as part of the DevOps Engineer path
Tools do not exist in isolation. Learn how CI/CD & GitHub Actions connects with other systems, CI/CD pipelines, and infrastructure patterns.