Git, CI/CD & GitOps for Infrastructure Engineers

Part I

Version Control Foundations

Purpose of version control; snapshots, history, collaboration, reproducibility, auditability, and the infrastructure-as-code implications.

6 lessons

Part II

Git Architecture

Working tree, index, repository, objects, refs, plumbing vs porcelain commands.

6 lessons

Part III

Git Objects

Blob, tree, commit, tag, OIDs, content-addressed storage, plumbing commands.

6 lessons

Part IV

Commit Graph and History

Parent relationships, DAG, ancestry, history traversal with git log.

6 lessons

Part V

Branches, Refs and HEAD

Branch pointers, references namespace, HEAD, detached HEAD state.

6 lessons

Part VI

Index / Staging Area

Working tree to index to repository, partial staging, interactive add.

6 lessons

Part VII

Repository Inspection

git status, git log, git show, git diff in all their forms.

6 lessons

Part VIII

Branching

Branch creation, switching, divergence, collaboration patterns.

6 lessons

Part IX

Merging

Fast-forward, three-way merge, merge commits, octopus merge.

6 lessons

Part X

Merge Conflicts

Realistic Terraform, Ansible, Kubernetes, YAML conflict resolution.

6 lessons

Part XI

Rebasing

Rebase mechanics, commit replay, interactive rebase, history rewriting.

6 lessons

Part XII

Merge vs Rebase

Trade-offs, when to use which, team policy.

6 lessons

Part XIII

Cherry-Pick

Backporting, hotfixes, duplicated-history implications.

6 lessons

Part XIV

Revert

Safe history-preserving reversal of changes.

6 lessons

Part XV

Reset

Soft, mixed, hard reset modes and destructive consequences.

6 lessons

Part XVI

Restore and Switch

Modern Git command separation introduced in Git 2.23.

6 lessons

Part XVII

Reflog

Recovery of reset commits, rebases, deleted branches, lost HEAD positions.

6 lessons

Part XVIII

Git Recovery

Realistic recovery workflows for lost work.

6 lessons

Part XIX

Tags and Releases

Lightweight, annotated, signed tags; release workflows.

6 lessons

Part XX

Remotes

Fetch, push, remote tracking branches, upstream relationships.

6 lessons

Part XXI

Fetch vs Pull

What each command actually does, when to use which.

6 lessons

Part XXII

Force Push

--force vs --force-with-lease, reflog-based safety, Production Warning.

6 lessons

Part XXIII

Worktrees

.git/worktrees mechanism, multiple working trees, infrastructure use cases.

6 lessons

Part XXIV

Bisect

Root-cause analysis to find the breaking infrastructure commit.

6 lessons

Part XXV

Hooks

Client-side, server-side hooks; limitations and enforcement boundaries.

6 lessons

Part XXVI

Git Configuration

Scopes (system/global/local/worktree), identity, signing configuration.

6 lessons

Part XXVII

Infrastructure Repository Architecture

Layout for Terraform, Ansible, Kubernetes, network, policy, documentation repos.

6 lessons

Part XXVIII

Monorepo vs Multi-Repo

Ownership, blast radius, CI performance, access control, dependencies.

6 lessons

Part XXIX

Branching Strategies

Trunk-based, short-lived branches, release branches, GitFlow contextually.

6 lessons

Part XXX

Pull Requests and Merge Requests

Review, diff, approvals, status checks, ownership, change reasoning.

6 lessons

Part XXXI

CODEOWNERS and Ownership Controls

Path-based ownership, required reviewers, bypass risks.

6 lessons

Part XXXII

Protected Branches

Direct-push restrictions, approvals, status checks, bypass risks.

6 lessons

Part XXXIII

Commit and Tag Signing

GPG and SSH signing for production verifiability.

6 lessons

Part XXXIV

Git Security

SSH, HTTPS tokens, credential storage, permissions, compromised accounts.

6 lessons

Part XXXV

Secrets in Git

Removing from current file does not remove from history; detection, rotation, cleanup.

6 lessons

Part XXXVI

Git History Rewriting

git filter-repo, BFG, scrubbing, re-signing, force-push blast radius.

6 lessons

Part XXXVII

CI Fundamentals

Commit to trigger to runner to job to steps to result.

6 lessons

Part XXXVIII

CI Architecture

Control plane, runners, jobs, environments, artifacts, caches, credentials.

6 lessons

Part XXXIX

Pipelines

Stages, jobs, dependencies and parallelism semantics.

6 lessons

Part XL

Runners

Hosted, self-hosted, ephemeral, persistent, isolation models.

6 lessons

Part XLI

Runner Security

Threat model: arbitrary code, production credentials, Docker socket, privileged containers.

6 lessons

Part XLII

CI Secrets

Secret variables, masking limitations, log leakage, environment scope.

6 lessons

Part XLIII

OIDC and Short-Lived Credentials

OIDC federation from CI to cloud, no long-lived production credentials.

6 lessons

Part XLIV

Artifacts

Build outputs, Terraform plans, packages, reports, images, manifests.

6 lessons

Part XLV

Artifact Immutability

Build once, promote the same artifact across environments.

6 lessons

Part XLVI

Caching

Performance plus cache-poisoning and stale-cache risks; cache versus artifact.

6 lessons

Part XLVII

Pipeline Dependencies

Actual DAG and stage semantics of the primary CI platform.

6 lessons

Part XLVIII

Conditional Execution

Branch, path, tag, environment conditions, expressions, matrix.

6 lessons

Part XLIX

Infrastructure CI

Format, lint, static analysis, security, tests, plan/diff, review.

6 lessons

Part L

Terraform CI

fmt, validate, lint, security, tests, plan-as-artifact, reviewed plan.

6 lessons

Part LI

Ansible CI

YAML lint, ansible-lint, syntax checks, Molecule, staged validation.

6 lessons

Part LII

Kubernetes CI

Manifests, Helm and Kustomize validation, policy, security scans.

6 lessons

Part LIII

Container CI

Build, tests, SBOM, scanning, signing, immutable digests.

6 lessons

Part LIV

Infrastructure Testing Strategy

Static, unit, integration, staging, production validation.

6 lessons

Part LV

Continuous Delivery versus Continuous Deployment

The actual distinction and when each fits.

6 lessons

Part LVI

Deployment Environments

Development, test, staging, production, identity isolation.

6 lessons

Part LVII

Approval Gates

When human approval adds safety and when it adds bureaucracy.

6 lessons

Part LVIII

Deployment Strategies

Rolling, canary, blue/green, recreate.

6 lessons

Part LIX

Rollback

Per-artifact rollback across containers, Kubernetes, Terraform, configuration, databases.

6 lessons

Part LX

Forward Fix versus Rollback

Operational decision-making between the two.

6 lessons

Part LXI

Pipeline Failure Handling

Retries, cleanup, partial deployment, resumability, idempotency.

6 lessons

Part LXII

Concurrency

Concurrent deployments, environment locking, Terraform state locks, serialization.

6 lessons

Part LXIII

CI/CD Observability

Queue duration, runtime, success/failure, flaky jobs, deployment success metrics.

6 lessons

Part LXIV

Auditability

Which commit, pipeline, artifact, approver, environment, tests, deployment.

6 lessons

Part LXV

Software Supply Chain Security

Source, dependencies, CI, artifact, registry, deployment as trust boundaries.

6 lessons

Part LXVI

Third-Party Actions and Plugins

Mutable references, compromised maintainers, abandoned projects, unexpected updates.

6 lessons

Part LXVII

Dependency Pinning

Actions, plugins, containers, providers, modules, collections, packages.

6 lessons

Part LXVIII

SBOM

Purpose, generation (syft, cyclonedx-bom, actions/attest), consumption.

6 lessons

Part LXIX

Artifact Signing

Cosign v3 keyless signing, Fulcio, Rekor, Bundle format.

6 lessons

Part LXX

Provenance

Where did this artifact come from; SLSA v1.2 Build track.

6 lessons

Part LXXI

CI/CD Threat Modelling

Malicious commit, account compromise, dependency compromise, runner compromise, secret leakage, artifact substitution, registry compromise.

6 lessons

Part LXXII

GitOps Foundations

Git to desired state to reconciliation controller to environment to drift detection.

6 lessons

Part LXXIII

Push versus Pull Deployment

Trust differences between CI pushing and controller pulling.

6 lessons

Part LXXIV

Reconciliation

Continuously reconciling Git desired state to actual cluster state.

6 lessons

Part LXXV

Drift

Manual, accidental, emergency changes; reconciliation, alerting on drift.

6 lessons

Part LXXVI

GitOps Repository Architecture

Application repos, environment repos, monorepo vs multi-repo, overlays, promotion.

6 lessons

Part LXXVII

Argo CD

Application, source, destination, sync, health, projects, RBAC, repositories, ApplicationSets.

6 lessons

Part LXXVIII

Flux

GitRepository, Kustomization, HelmRelease, OCIRepository, image automation, notifications.

6 lessons

Part LXXIX

Sync Strategies

Manual sync, automated sync, self-heal, pruning - per controller capability.

6 lessons

Part LXXX

GitOps Pruning

Desired-state deletion and blast radius; Production Warning.

6 lessons

Part LXXXI

Synced versus Healthy

Reconciliation is not the same as application health.

6 lessons

Part LXXXII

GitOps Secrets

External secret systems, encrypted Git workflows, secret references.

6 lessons

Part LXXXIII

GitOps RBAC

Repository permissions, controller permissions, cluster access, environment boundaries.

6 lessons

Part LXXXIV

Environment Promotion

Development, test, staging, production with immutable artifact promotion.

6 lessons

Part LXXXV

GitOps Rollback

git revert is not the same as data rollback.

7 lessons

Part LXXXVI

GitOps Failure Modes

Repository unavailable, auth failure, controller unavailable, bad manifests, unhealthy deployment, prune incident, secret dependency failure.

6 lessons

Part LXXXVII

GitOps During Incidents

Pragmatic break-glass: incident, emergency change, restore, document, update Git, restore reconciliation.

6 lessons

Part LXXXVIII

Infrastructure GitOps

Beyond simple application deployment where tooling actually supports it.

6 lessons

Part LXXXIX

Repository Security

MFA, access control, branch protection, signing, ownership, audit.

6 lessons

Part XC

CI Platform Security

What CI can access: cloud, Kubernetes, Terraform state, registries, secret stores, production networks.

6 lessons

Part XCI

Least Privilege CI/CD

Validation identity is not the production deployment identity.

6 lessons

Part XCII

Protected Environments

Platform mechanisms for production environment protection.

6 lessons

Part XCIII

Credential Rotation

Deploy keys, tokens, cloud credentials, registry credentials, GitOps credentials.

6 lessons

Part XCIV

Incident: Secret Leak

Response order - revoke/rotate first, assess exposure, inspect usage, remove repo exposure, audit, prevent recurrence.

6 lessons

Part XCV

Incident: Compromised Runner

Isolation, credential revocation, artifact impact analysis, job history, clean rebuild.

6 lessons

Part XCVI

Incident: Malicious Dependency

Stop builds, identify impacted artifacts, rotate credentials, rebuild trusted artifacts, improve controls.

6 lessons

Part XCVII

CI/CD Disaster Recovery

Recovery of CI configuration, runners, secrets, artifact registry, deployment process.

6 lessons

Part XCVIII

Git Hosting Failure

Continuity options and limitations.

7 lessons

Part XCIX

Artifact Registry Failure

Impact on deployment and recovery.

6 lessons

Part C

Runner Capacity

Queueing, concurrency, ephemeral runner sizing, autoscaling.

6 lessons

Part CI

Pipeline Performance

Optimisation only after measurement.

6 lessons

Part CII

Large Repository Performance

Binaries, Git LFS, shallow/partial clones, repository design.

6 lessons

Part CIII

Infrastructure Repository Anti-Patterns

Committed secrets, Terraform state in Git, generated files, no ownership, direct production pushes, mutable dependencies.

6 lessons

Part CIV

CI/CD Anti-Patterns

Permanent privileged runners, secrets in logs, mutable dependencies, no artifact identity, rebuilding per environment, unsafe automatic apply.

6 lessons

Part CV

GitOps Anti-Patterns

Cluster-admin everywhere, unsafe prune, plaintext secrets, uncontrolled drift, no environment separation.

6 lessons

Part CVI

Change Management

Every infrastructure change answers: what, why, which commit, which environment, which artifact, what validation, what blast radius, what rollback, who owns it.

6 lessons

Part CVII

Production Infrastructure Delivery Architecture

Reference diagram of engineer to Git to pull request to CI to artifact to approval to GitOps to production.

6 lessons

Part CVIII

Infrastructure-as-Code Integration

How Terraform, Ansible, Kubernetes, Docker, networking pipelines connect.

6 lessons

Part CIX

Terraform Delivery Pipeline

End-to-end Terraform delivery: lint, validate, scan, plan, review, apply, drift, audit.

6 lessons

Part CX

Ansible Delivery Pipeline

End-to-end Ansible delivery: lint, syntax, Molecule, staged validation, idempotency.

6 lessons

Part CXI

Kubernetes Delivery Pipeline

CI plus GitOps for Kubernetes workloads.

6 lessons

Part CXII

Container Delivery Pipeline

Source, test, build, SBOM, scan, sign, registry, deploy.

6 lessons

Part CXIII

Observability Integration

Deployment-event correlation across metrics, logs, traces.

6 lessons

Part CXIV

Deployment Markers

Deployment, telemetry annotation/event, performance/error change correlation.

6 lessons

Part CXV

Production Operating Model

Responsibilities among application, platform, infrastructure, security, reviewers.

6 lessons

Part CXVI

Governance Without Bureaucracy

Controls that improve safety without meaningless approval chains.

6 lessons

Part CXVII

Compliance and Audit

Reconstruction: who, what, why, which commit, artifact, pipeline, tests, environment.

6 lessons

Part CXVIII

Final Reference Architecture

Complete production-quality reference: Git, CI control plane, ephemeral runners, artifact registry, secret manager, short-lived identities, GitOps controllers, environments, observability, audit.

6 lessons

Part Labs

Labs

Hands-on disposable-environment labs covering Git plumbing, conflict resolution, recovery, CI/CD pipeline construction, supply-chain tooling, GitOps controller installation, drift, rollback, and incident response.

0 lessons

Part Runbooks

Runbooks

Operational procedures for Git recovery, CI failure triage, runner restoration, secret leak response, GitOps reconciliation, environment promotion, and supply-chain compromise.

0 lessons

Part Checklists

Checklists

Production readiness reviews for repositories, pipelines, runners, supply chains, artifacts, deployments, GitOps, secrets, rollback, and DR.

0 lessons

Part Breakfix

Break/Fix Scenarios

Evidence-first diagnosis of Git, CI/CD, and GitOps failure modes (recovery, secrets, runner, dependency, environment, prune, reconcile).

0 lessons

Part Capstone

Production Capstone

A complete production infrastructure delivery environment with ten injected incidents.

0 lessons

Part Final

Final Assessment

Final theory assessment plus final practical assessment of an inherited delivery environment.

6 lessons