# Ci Cd
All Ci Cd notes →What is GitOps
A declarative delivery model where Git is the single source of truth for desired system state, and an in-cluster controller continuously reconciles live state to match it — the operating model behind ArgoCD and FluxCD.
1 — The Evolution of Software Delivery
Traces the path from manual, ticket-driven releases through DevOps automation to platform-engineered software factories that treat delivery itself as a product.
2 — What Is a CI/CD Platform?
Defines a CI/CD platform as a product with its own responsibilities, consumers, shared services, and capability surface, rather than a single pipeline tool.
3 — CI/CD Platform Architecture
Lays out the seven-layer reference architecture — developer, source control, build, artifact, deployment, runtime, and feedback — that the rest of the book is organized around.
4 — Platform Maturity Model
Defines a five-stage maturity curve from manual delivery to autonomous delivery, used throughout the book to benchmark platform capability.
1 — Git as the Platform Backbone
Covers how branching strategy, trunk-based development vs GitFlow, and monorepo vs polyrepo choices shape everything a CI/CD platform has to support.
2 — Pipeline Architecture
Compares pipeline-as-code, declarative pipeline models, event-driven triggering, and workflow orchestration as the architectural building blocks of any pipeline system.
3 — Pipeline Design Principles
Establishes idempotency, reusability, modularity, parameterization, and composability as the design principles that separate a maintainable pipeline from a fragile one.
4 — Pipeline Lifecycle
Walks the full pipeline lifecycle — trigger, build, test, package, deploy, verify, promote, rollback — as the canonical stage model referenced throughout the book.
5 — GitHub Actions: CI/CD Design Patterns
Covers build-once-deploy-many, immutable artifacts, promotion pipelines, GitOps, and trunk-based development as durable CI/CD design patterns.
1 — Build Platform Architecture
Describes the architecture of a build platform — distributed builds, build farms, build agents, and the hosted-vs-self-hosted runner trade-off.
2 — Build Optimization
Covers incremental builds, parallelization, dependency caching, and remote build caches as the levers for cutting build time at scale.
3 — Build Standardization
Explains how shared build templates, org-wide standards, build libraries, and reusable pipeline components keep hundreds of teams' builds consistent.
4 — Build Reliability
Covers retry strategies, build health signals, diagnostics, and observability practices that keep a build platform trustworthy at scale.
5 — GitHub Actions: Cache Optimization
Covers dependency caching, cache key and restore-key design, diagnosing cache misses, and the performance tradeoffs of aggressive caching.
6 — GitHub Actions: Pipeline Performance
Covers parallelism, dependency-graph optimization, cache strategy, and artifact-size optimization for faster pipelines.
1 — CI Architecture
Covers event-driven CI triggering, pipeline orchestration, fan-in/fan-out pipeline shapes, and matrix builds as the architectural patterns behind a CI platform.
2 — Automated Testing Platform
Surveys the automated test pyramid a CI platform must support — unit, integration, contract, end-to-end, and performance tests — and how each shapes pipeline design.
3 — Code Quality Platform
Covers static analysis, code coverage, linting, and dependency analysis as the code-quality gates a CI platform enforces before code merges.
4 — Security in CI
Covers secret detection, SAST, dependency scanning, container scanning, and license compliance as the security gates built into the CI stage.
5 — GitHub Actions: Performance Engineering
Covers k6-based load testing, benchmarking, and automated performance regression detection inside a pipeline.
1 — Artifact Management
Covers artifact repositories, OCI registries, language package repositories, and versioning schemes as the foundation of an artifact platform.
2 — Artifact Lifecycle
Walks an artifact's lifecycle from publishing through promotion, retention policy, and cleanup, and why each stage needs explicit platform support.
3 — Software Supply Chain
Covers build provenance, SBOMs, artifact signing, and verification as the software-supply-chain controls layered on top of artifact storage — see kubernetes/08-supply-chain-security for the Sigstore/cosign/SLSA implementation detail.
4 — Dependency Management
Covers internal library management, third-party dependency handling, repository mirroring, and dependency governance policy at platform scale.
5 — GitHub Actions: Artifacts
Covers uploading and downloading build artifacts, retention policy tuning, handling large files, and publishing test/report artifacts from a workflow run.
1 — Deployment Architecture
Contrasts push- and pull-based deployment, introduces GitOps and deployment controllers, and covers environment promotion — see tech/gitops.md, tech/argocd.md, and tech/fluxcd.md for the tool-level mechanics.
2 — Environment Management
Covers how a delivery platform manages the development, testing, staging, production, and ephemeral-environment tiers as first-class platform resources.
3 — Deployment Strategies
Compares rolling updates, blue-green, canary, shadow deployments, and A/B testing as the deployment strategies a delivery platform must offer as reusable primitives.
4 — Progressive Delivery
Covers feature flags, automated verification, traffic shifting, and progressive rollouts as the mechanics behind safely decoupling deploy from release.
1 — Why GitHub Actions
Explains what event-driven automation on the GitHub ecosystem buys you, compares GitHub Actions against Jenkins, Azure DevOps, GitLab CI, CircleCI, Buildkite, and Tekton, and calls out when NOT to reach for GitHub Actions at all.
10 — Reusable Workflows
Covers workflow_call, typed inputs/outputs/secrets, and versioning and best-practice conventions for DRY, org-shared CI, grounded in this repo's own reusable Docker, .NET, Python, and Terraform workflows.
11 — Composite Actions
Compares composite actions, JavaScript actions, and Docker actions as ways to package and publish reusable steps to the Marketplace.
12 — Workflow Templates
Covers organization and enterprise workflow templates as a governance and standardization mechanism across many repositories.
13 — GitHub-Hosted Runners
Covers GitHub-hosted runner images, resource limits, performance characteristics, and billing model.
14 — Self-Hosted Runners
Covers self-hosted runner installation, labels, runner groups, scaling, autoscaling, security hardening, and maintenance for enterprise fleets.
15 — Actions Runner Controller (ARC)
Covers running Actions Runner Controller on Kubernetes — runner scale sets, autoscaling, ephemeral runners, and enterprise fleet architecture.
16 — Monorepo Pipelines
Covers path filters, selective builds, dependency graphs, and incremental builds for CI in a monorepo.
17 — Large-Scale Repository Automation
Covers automating CI/CD across many repositories, org-wide shared workflows, and governance at scale.
18 — Azure
Covers Azure Login, ARM templates, AKS, Container Apps, Functions, Key Vault, Bicep, and Terraform deployment from a workflow.
19 — AWS
Covers IAM, OIDC federation, ECS, Lambda, and EKS deployment from a workflow.
2 — GitHub Actions Architecture
Walks the full GitHub Actions object model — repositories, events, workflows, jobs, steps, runners, the Marketplace, artifacts, cache, packages, and environments — and how they compose.
20 — Google Cloud
Covers GKE, Cloud Run, and Workload Identity Federation deployment from a workflow.
21 — Containers
Covers building with Docker and Buildx, multi-stage and multi-arch builds, and image signing in CI.
22 — Kubernetes
Covers deploying to Kubernetes from a workflow with kubectl, Helm, and Kustomize, versus triggering GitOps reconciliation via ArgoCD or FluxCD.
3 — YAML Essentials
Covers the YAML syntax, expressions, variables, anchors, and multiline string forms that every GitHub Actions workflow file depends on.
4 — Workflow Syntax
Documents the top-level workflow keys — name, on, jobs, steps, uses, run, env, defaults, permissions, and concurrency — and how they interact.
5 — Events & Triggers
Surveys the trigger surface — push, pull_request, workflow_dispatch, workflow_call, schedule, repository_dispatch, release, issue and issue_comment events, tags, and branch/path filters — for deciding what fires a workflow.
6 — Expressions & Contexts
Details the github, env, vars, secrets, matrix, strategy, needs, runner, job, steps, and inputs/outputs contexts plus expression functions like hashFiles() used to make workflows conditional and data-driven.
7 — Running Jobs
Covers sequential vs. parallel job execution, job dependencies via needs, conditional job/step execution, and continue-on-error semantics for fault-tolerant pipelines.
8 — Matrix Builds
Explains matrix strategy fan-out, dynamic matrices computed at runtime, include/exclude overrides, and common OS and language matrix patterns.
9 — Workflow Outputs
Covers job outputs, step outputs, and passing data between jobs and reusable workflows without relying on shared filesystem state.
1 — Argo Workflows
Covers Argo Workflows' architecture, DAG-based workflow definitions, event integration, and scheduling as a Kubernetes-native CI/CD orchestration engine.
2 — Tekton
Covers Tekton Pipelines, Tasks, the Tekton Catalog, and Triggers as the CRD-based building blocks of a Kubernetes-native, vendor-neutral CI/CD engine.
3 — Jenkins Platform
Covers Jenkins controller architecture, agents, shared libraries, and the modern Jenkins (Configuration-as-Code, cloud-native agents) evolution.
4 — Choosing the Right Platform
Compares GitHub Actions, Argo Workflows, Tekton, and Jenkins against organizational constraints, and covers hybrid models that combine more than one.
1 — Release Engineering Fundamentals
Covers the release lifecycle, release planning, release trains, and versioning schemes as the fundamentals of disciplined release engineering.
2 — Release Automation
Covers automated releases, promotion pipelines, release validation gates, and rollback mechanics as the automation layer over manual release processes.
3 — Deployment Governance
Covers change approval workflows, risk assessment, compliance gates, and audit trails as the governance controls layered over deployment automation.
4 — Release Observability
Covers deployment metrics, failure analysis, release dashboards, and incident correlation — see platform-engineering-fundamentals' DORA metrics chapter for the underlying KPI definitions.
1 — Identity & Access Management
Covers identity and access management for a CI/CD platform — workload identity, human access, and the boundary between the two.
2 — Secret Management
Covers how a CI/CD platform stores, rotates, injects, and audits secrets used by pipelines and deployments.
3 — Policy as Code
Covers expressing security and compliance rules as versioned, testable policy-as-code enforced at pipeline gates.
4 — Secure Pipeline Design
Covers the design practices — least privilege, isolation, signed artifacts, hardened runners — that make a pipeline itself resistant to compromise.
5 — Software Supply Chain Security
Covers securing the end-to-end software supply chain from source to production — see kubernetes/08-supply-chain-security for SBOM, signing, and SLSA implementation detail.
6 — Compliance Automation
Covers automating compliance evidence collection and control enforcement directly inside the CI/CD platform rather than as a manual audit exercise.
7 — GitHub Actions: Authentication
Covers the GITHUB_TOKEN, fine-grained PATs, GitHub Apps, and OIDC federation to Azure, AWS, and GCP as the four authentication mechanisms available to a workflow.
8 — GitHub Actions: Secrets Management
Covers repository, organization, and environment secrets and variables, secret rotation, and least-privilege scoping for CI credentials.
9 — GitHub Actions: Secure Pipelines
Covers dependency review, CodeQL, secret scanning, artifact attestations, branch protection, required reviews, signed commits, and supply chain security gates enforced inside a workflow.
1 — Pipeline Metrics
Covers build duration, queue time, success rate, and failure rate as the core pipeline metrics a platform should expose by default.
2 — CI/CD Logging
Covers structured, centralized logging for pipeline runs — build logs, deployment logs, and audit logs — as a platform-provided capability.
3 — Pipeline Tracing
Covers distributed tracing across pipeline stages and services to diagnose where time and failures actually accumulate in a delivery flow.
4 — CI/CD Dashboards
Covers building dashboards that surface pipeline health, delivery throughput, and failure trends to both platform teams and their consumers.
5 — Delivery SLOs
Covers defining SLOs for the delivery platform itself — pipeline availability, queue latency, deployment success rate — as a product with its own reliability target.
6 — GitHub Actions: Notifications
Covers routing workflow status to Slack, Teams, email, GitHub notifications, and ChatOps integrations.
7 — GitHub Actions: Failure Analysis
Covers retry strategies, timeout tuning, debug logging, and treating a broken pipeline as an incident to respond to.
1 — High Availability
Covers designing the CI/CD control plane itself for high availability so pipeline outages don't become an organization-wide delivery outage.
2 — Scaling Pipeline Platforms
Covers horizontal and vertical scaling strategies for build farms, runners, and orchestration control planes as pipeline volume grows.
3 — Disaster Recovery
Covers backup, failover, and recovery procedures for CI/CD control planes, artifact stores, and pipeline state.
4 — Platform Capacity Planning
Covers forecasting build and deployment demand and provisioning runner and orchestration capacity ahead of it.
5 — Incident Response
Covers incident response specific to CI/CD platform outages — detection, triage, and communication when the delivery system itself is down.
1 — Multi-Cloud Delivery
Covers designing delivery pipelines that build and deploy consistently across more than one cloud provider.
2 — Multi-Region Deployments
Covers coordinating deployments across multiple regions with staggered rollout, region-aware promotion, and blast-radius containment.
3 — Multi-Tenant Pipeline Platforms
Covers isolating tenants — teams, business units, or customers — sharing a single CI/CD platform without leaking access, quota, or blast radius.
4 — Platform Governance
Covers the organizational governance model — ownership, standards enforcement, exception handling — for a CI/CD platform used across an enterprise.
5 — Platform Cost Engineering
Covers attributing and optimizing the cost of build compute, runner fleets, artifact storage, and pipeline minutes at enterprise scale.
6 — Developer Experience
Covers measuring and improving the developer-facing experience of using the CI/CD platform — feedback latency, self-service, and cognitive load.
7 — GitHub Actions: Cost Optimization
Covers GitHub Actions minutes billing, storage costs, self-hosted runner economics, and concrete techniques to reduce CI spend.
1 — Pipeline Sprawl
Covers the anti-pattern of unbounded, inconsistent pipeline proliferation across teams with no shared standard or ownership.
2 — Copy-Paste Pipelines
Covers the anti-pattern of duplicating pipeline definitions across repos instead of sharing templates, and the maintenance debt it creates.
3 — Manual Releases
Covers the anti-pattern of releases that still depend on manual steps, and the risk and toil that persist as a result.
4 — Shared Credentials
Covers the anti-pattern of long-lived, shared pipeline credentials instead of scoped, short-lived, workload-specific identity.
5 — Long-Running Pipelines
Covers the anti-pattern of pipelines that grow slower over time without bound, and why that erodes developer trust in the platform.
6 — Lack of Standardization
Covers the anti-pattern of every team inventing its own pipeline conventions, and the platform cost of not investing in shared standards.
7 — Ignoring Pipeline Observability
Covers the anti-pattern of operating a CI/CD platform with no metrics, logs, or SLOs of its own, and the outages that follow.
1 — CI/CD Platform System Design
Covers how to approach a CI/CD platform system design interview end to end — see system-design's dedicated CI/CD platform case study for a fully worked example.
2 — Designing Enterprise Build Platforms
Covers the interview framing for designing a distributed build platform at enterprise scale — requirements, architecture, and trade-offs.
3 — Progressive Delivery Design
Covers the interview framing for designing a progressive delivery system — feature flags, traffic shifting, automated verification, and rollback.
4 — GitHub Actions Interview Questions
GitHub Actions interview questions graded beginner through principal, for calibrating depth expected at each level.
5 — Release Engineering Case Studies
Walks through worked release-engineering case studies — release trains, promotion pipelines, rollback design — in interview format.
6 — Staff/Principal Platform Engineering Scenarios
Covers open-ended staff/principal-level platform engineering scenarios that probe organizational, not just technical, judgment.
7 — GitHub Actions: Enterprise Scenarios
Covers designing a CI platform, securing multi-tenant pipelines, monorepo-at-scale builds, thousands of concurrent builds, and a global runner fleet as MAANG-style design prompts.
8 — GitHub Actions: Case Studies
Walks CI/CD platform design through real-world shaped case studies — SaaS, microservices, monolith, and enterprise migration.
1 — CI/CD Platform Reference Architecture
A reference architecture diagram and component checklist consolidating the platform layers covered across the book.
10 — GitHub Actions: Practice Exams
Three full mock GH-200 exams with detailed answer explanations for exam-readiness self-assessment.
11 — GitHub Actions: Troubleshooting Playbook
A troubleshooting playbook for debugging pipeline failures, performance issues, security incidents, and production outages traced back to CI/CD.
12 — GitHub Actions: YAML Reference
A YAML syntax quick-reference for GitHub Actions workflow authoring.
13 — GitHub Actions Expression Cheat Sheet
A cheat sheet of GitHub Actions expression functions and operators.
14 — GitHub Actions: Context Reference
A reference of every built-in GitHub Actions context object and its fields.
15 — GitHub Actions: Marketplace Best Practices
Best practices for choosing, pinning, and auditing third-party Marketplace actions.
16 — GitHub Actions: GitHub CLI (gh) Reference
A gh CLI command reference for scripting GitHub Actions and repository operations.
17 — GitHub Actions: Common Error Messages
A lookup of common GitHub Actions error messages and their root causes.
18 — GitHub Actions: GH-200 Exam Checklist
A final GH-200 exam-day readiness checklist.
19 — GitHub Actions: MAANG Interview Checklist
A final MAANG CI/CD interview readiness checklist.
2 — GitHub Actions: Migration Guide
A migration guide for moving existing pipelines from Jenkins, Azure DevOps, or GitLab CI to GitHub Actions.
3 — Argo Workflows & Tekton Comparison Matrix
A side-by-side comparison matrix of Argo Workflows and Tekton across architecture, extensibility, and operational model.
4 — Progressive Delivery Decision Matrix
A decision matrix for choosing among rolling, blue-green, canary, and shadow deployment strategies based on risk and rollback needs.
5 — Software Supply Chain Security Checklist (SLSA, SBOM, Sigstore)
A checklist of SLSA levels, SBOM requirements, and Sigstore signing/verification steps for hardening a software supply chain.
6 — DORA Metrics & Delivery KPIs
A quick-reference of the four DORA metrics and related delivery KPIs — see platform-engineering-fundamentals' DORA metrics chapter for the full derivation.
7 — CI/CD Platform Maturity Model
A quick-reference recap of the five-stage platform maturity model introduced in Part I, for use as a self-assessment checklist.
8 — GitHub Actions: GH-200 Exam Objectives
Maps the GH-200 exam blueprint — workflow authoring, security, automation, runner administration, and governance — to the chapters in this book.
9 — GitHub Actions: Hands-on Labs
A set of 25 guided, hands-on labs built from realistic enterprise scenarios for GH-200 practice.
CI/CD Platform Engineering
A book-shaped table of contents for CI/CD platform engineering: pipeline foundations, build/artifact/delivery platforms, GitHub Actions end to end (workflow mechanics through enterprise governance), Argo Workflows, Tekton, Jenkins, release engineering, platform security, observability, reliability, enterprise governance, and MAANG interview preparation — cross-linking existing tech/kubernetes/platform-engineering-fundamentals/system-design notes instead of duplicating them.
# Projects
All Projects notes →06 — Build & Release
From local dev to production: CI/CD, releases, deploys, and rollbacks.
CI/CD Pipeline Guide
How platform changes flow through CI/CD.
Deployment Runbooks
Step-by-step deployment runbooks per component.
Development Environment Setup
Set up a local dev environment to work on platform config.
Release Notes
Per-release notes.
Release Process
The platform release process — cadence, versioning, and approvals.
Rollback Procedures
How to roll back each component safely.
Adopting the ShipSolid Central Terraform CI/CD Pipeline
- Org consistency across all ShipSolid Terraform repos (Grafana Cloud IaC, SDLC Portal infra,
CI/CD Overview
The repo currently uses three CI/CD layers:
Code Standards
This document defines the mandatory code standards for all services and infrastructure in this
Migrating to Terraform Cloud (TFC / HCP Terraform)
Migrating to Terraform Cloud (TFC / HCP Terraform) is mostly mechanical, but there's one
Naming Conventions
This document defines the naming patterns for all resources, files, and artifacts in this monorepo.
Pre-commit Hooks
This repo uses [pre-commit](https://pre-commit.
Terraform Driver Styles
The repo runs Terraform two different ways.