CI/CD, GitOps & DevSecOps — Engineering Field Guide
Phase 4 · Source-reviewed 11 October 2026. These lessons analyse repository code and configuration, not the present state of cloud infrastructure. Start with read-only and local validation. Never deploy or push to an external registry without reviewing permissions and costs.
Learning objectives
By the end, explain the difference between building, publishing, deploying and verifying an artifact; map GitHub workflow permissions onto AWS OIDC; distinguish an SBOM from an attestation; diagnose image and GitOps sync failures; and describe a safe release/rollback plan.
| Lesson | Focus | Anchoring repository |
|---|---|---|
| 01 · Delivery boundaries | CI, delivery, deployment and evidence | CI/CD Pipeline |
| 02 · GitHub OIDC & identity | Trust policies and least-privilege jobs | Terraform EKS |
| 03 · Hardened containers | Image pinning and runtime defence | CI/CD Pipeline |
| 04 · SBOM & attestations | Supply-chain evidence and provenance | CI/CD Pipeline |
| 05 · Infrastructure quality gates | Terraform validation, tests, scanning, plans | Terraform EKS |
| 06 · Argo CD reconciliation | Desired state, sync, drift and prune | GitOps Argo CD |
| 07 · EKS release engineering | Artifact digest, rollout, health, rollback | Pharmacy API EKS |
| 08 · Incident troubleshooting | Failed builds, access, scans, syncing | Multiple repositories |
| 09 · Connected architecture | Evidence trail, trust boundaries and handoffs | Multiple repositories |
| 10 · Review exercises | Interview and design practice | Multiple repositories |
Evidence standard
- Implemented in source: a concrete workflow or manifest can be inspected.
- Documented or previously demonstrated: the README/screenshots say an action occurred; not proof of current uptime.
- Proposed improvement: a recommendation, not an existing capability.
See the Engineering Evidence Guide, Chapter 8 and Phase 3 cloud labs.
Safe lab operating model
Prefer inspecting checked-in workflow files and running non-destructive local checks. Commands that assume AWS, EKS or Argo CD access are diagnostic examples only. Require an authorized context and explicit review before any write, push, sync, rollback, apply or prune.