ci-cd

CI/CD pipelines

Ship safely on every push — pipelines, caching, and tests that gate a merge, with GitHub Actions.

13 units·43 lessons·~12 h

Start track →

00

Start from zero

What CI and CD are, and the pipeline mental model.

01 What CI/CD actually is 14 min

01

Pipelines

A workflow is jobs of steps, triggered by events, cached and parallelized.

01 GitHub Actions: workflows, jobs, steps 16 min 02 Caching, matrix builds and artifacts 16 min 03 Secrets, environments and OIDC 16 min

02

Testing in CI

Balance the test pyramid and make the right checks block a merge.

01 The test pyramid and required checks 16 min 02 Vitest/Jest unit + Playwright e2e in CI 17 min 03 Contract testing and taming flaky tests 17 min

03

Delivery and deploy

Get a tested artifact safely into production.

01 Continuous delivery vs deployment, and release strategies 17 min 02 Environments, approvals, and rollback 17 min 03 Build once, promote many: immutable artifacts 16 min

04

Release automation

Version and release without manual toil.

01 SemVer, conventional commits, and automated changelogs 16 min 02 Tagging and publishing releases from CI 16 min 03 Progressive delivery: canary, blue-green and flags 18 min 04 Safe schema migrations and rollback 19 min 05 Build once, promote everywhere: artifacts and environments 18 min

05

Supply chain

Trust what you ship.

01 SBOM, build provenance, and signing: prove what you ship 17 min 02 Dependency and secret hygiene: hardening CI itself 17 min 03 Dependency confusion and typosquatting 18 min 04 Pipeline security and poisoned builds 19 min 05 Verifying provenance and policy gates 19 min

06

Scaling CI

Keep CI fast as the repo grows.

01 Monorepo CI: affected-only builds and remote caching 17 min 02 Pipeline performance: caching, parallelism, fail-fast 17 min 03 Test sharding and flaky-test quarantine 18 min 04 Runner infrastructure and CI cost at scale 18 min 05 Merge queues and keeping main green 18 min

07

Putting it together

Design a complete pipeline end to end.

01 Capstone: design a complete CI/CD pipeline end to end 19 min

08

Workflows deep

A workflow is an event-driven graph of jobs; triggers, contexts and expressions decide what runs, where, and with what data.

01 Events and triggers: what fires a workflow, and the pull_request_target trap 16 min 02 Contexts and expressions: the data model, and script injection via github.event 16 min 03 Jobs, matrix, and reuse: the DAG, fan-out limits, and reusable-workflow nesting 17 min 04 Artifacts and caching: passing files between jobs, and the cache that never hits 16 min

09

Authoring actions

An action packages reusable steps three ways — composite, JavaScript, Docker — each with a different runtime, speed and portability tradeoff.

01 Composite actions: bundling steps with zero runtime overhead 15 min 02 JavaScript actions: the node20 runtime, the toolkit, and the ncc bundle 16 min 03 Docker actions: total environment control at the cost of Linux-only and image overhead 16 min

10

Security and OIDC

CI is a privileged execution environment: scope GITHUB_TOKEN, prefer OIDC over long-lived cloud keys, and never trust untrusted input in a run step.

01 The GITHUB_TOKEN: default permissions, least privilege, and why read-all is a footgun 16 min 02 OIDC to the cloud: short-lived tokens instead of long-lived AWS keys, and pinning the sub claim 17 min 03 Untrusted input in CI: script injection via interpolated context and the pull_request_target pwn-request 17 min

11

Runners and scale

Runners are where cost and speed live: hosted vs self-hosted, autoscaling, and cache strategy decide CI throughput and the bill.

01 Hosted vs self-hosted runners: the spec, the bill, and the public-repo trap 16 min 02 Autoscaling with Actions Runner Controller: ephemeral pods that scale to the queue 17 min 03 Cache and cost strategy: restore-keys hierarchy, the 10 GB eviction wall, and Docker layer cache 16 min

12

Release engineering

Release engineering turns a green pipeline into a governed delivery: versioning, changelogs, and environment gates make a deploy auditable and reversible.

01 Versioning and tags: semver, conventional commits, and the immutable release ref 16 min 02 Changelogs and releases: generated notes, PR labels, and the human-facing record 15 min 03 Environments and gates: required reviewers, wait timers, and branch protection 16 min 04 Capstone: reading a real deploy.yml as a release-engineering case study 18 min

Build with this track

Guided projects that exercise what you learn here.

Threat-Model and Harden a Small App

Take a small app you fully own and run it through the loop a real security engineer lives in: first map how an attacker would actually break it, then close those paths one by one. You build an attack tree against your own service, then fix authentication, authorization, secrets handling, security headers, and input validation — and write down which fix kills which branch of the tree. This is the whole craft of defensive security in miniature: not a checklist, but a chain from threat to mitigation you can defend out loud.

URL shortener at scale

Build a URL shortener that survives real traffic — then run it: deploy it, watch it, and work the incident when one hot link melts your cache.

Node.js, zero to senior

The runtime behind your backend — event loop, modules, async and streams — built up to senior depth.