Curriculum

1. 01Version control foundations — snapshots, history, and auditabilityFoundations · foundation · ~18 min
2. 02Snapshots and the history model — what a commit really recordsFoundations · foundation · ~18 min
3. 03Collaboration and conflict — concurrent edits and the merge boundaryFoundations · foundation · ~20 min
4. 04Reproducibility and immutable references — the commit hash as the unit of reproducibilityFoundations · foundation · ~17 min
5. 05Auditability and chain of trust — from production state back to a commitFoundations · foundation · ~19 min
6. 06Infrastructure-as-code implications — why IaC has a stricter version-control bar than application codeFoundations · foundation · ~20 min

1. 01The working tree, the index, and the repository — the three areas Git operates onArchitecture · foundation · ~19 min
2. 02The three-trees model — HEAD, index, and working tree as a navigation systemArchitecture · foundation · ~18 min
3. 03Plumbing versus porcelain — the low-level commands Git is built onArchitecture · intermediate · ~21 min
4. 04The .git directory layout — what lives where under the repositoryArchitecture · intermediate · ~20 min
5. 05Environment variables and config files — how Git finds its repository and its settingsArchitecture · intermediate · ~20 min
6. 06Git as a content-addressed store — why hashes are the identityArchitecture · intermediate · ~19 min

1. 01The three object types — blob, tree, commit, tagGit Objects · intermediate · ~18 min
2. 02Object IDs and hashing — what the SHA covers and why collisions matterGit Objects · intermediate · ~20 min
3. 03Blob objects — content only, no filename, deduplicated by hashGit Objects · intermediate · ~17 min
4. 04Tree objects — directory entries, mode bits, and recursive sub-treesGit Objects · intermediate · ~21 min
5. 05Commit objects — parents, tree pointers, author versus committer, signaturesGit Objects · intermediate · ~22 minLab
6. 06Tag objects — annotated tags, lightweight tags, and signed tagsGit Objects · intermediate · ~19 min

1. 01The commit DAG — what Git is really a graph ofCommit Graph and History · intermediate · ~18 min
2. 02Parent references — first parent versus all parentsCommit Graph and History · intermediate · ~18 min
3. 03Ancestry and reachability — what `reachable` actually meansCommit Graph and History · intermediate · ~20 min
4. 04History traversal — log options that actually change the graph walkCommit Graph and History · intermediate · ~20 min
5. 05Graph topology and merges — what merge commits actually encodeCommit Graph and History · intermediate · ~22 minLab
6. 06The octopus and its cost — when multi-parent merges help and when they hurtCommit Graph and History · intermediate · ~20 min

1. 01Refs and the refs namespace — refs/heads, refs/tags, refs/remotesBranches, Refs and HEAD · intermediate · ~18 min
2. 02Branches are pointers — what a branch really isBranches, Refs and HEAD · intermediate · ~17 min
3. 03HEAD and current state — what HEAD actually isBranches, Refs and HEAD · intermediate · ~16 min
4. 04Detached HEAD state — what it means, why it is dangerous, and how to recoverBranches, Refs and HEAD · intermediate · ~18 min
5. 05Tags versus branches — what tags are for, annotated versus lightweight, and why branches are not releasesBranches, Refs and HEAD · intermediate · ~18 min
6. 06Packed refs and the reflog — when refs are packed, and how the reflog records every ref changeBranches, Refs and HEAD · intermediate · ~19 min

1. 01The index explained — what the staging area is and why Git has oneIndex · intermediate · ~18 min
2. 02git add mechanics — what staging actually does under the hoodIndex · intermediate · ~20 min
3. 03Partial staging with -p — hunk-level staging for clean commitsIndex · intermediate · ~21 min
4. 04Staging versus skipping — git add, .gitignore, and the untracked bucketIndex · intermediate · ~19 min
5. 05The index as a commit preview — git diff --cached and the review before commitIndex · intermediate · ~17 min
6. 06Resetting and restore on the index — git reset, git restore, and choosing the right undoIndex · intermediate · ~22 min

1. 01git status decoded — staged, unstaged, untracked, and the porcelain contractInspection · intermediate · ~18 min
2. 02git log fundamentals — reading history, decoding the default outputInspection · intermediate · ~18 min
3. 03git log formatting — pretty formats, custom output, and machine-readable contractsInspection · intermediate · ~20 min
4. 04git show and the commit object — inspecting one commit in fullInspection · intermediate · ~17 min
5. 05git diff three ways — working tree, index, and HEADInspection · intermediate · ~21 min
6. 06git blame and annotation tracking — per-line authorship and code archaeologyInspection · intermediate · ~19 min

1. 01Branch creation and switching — git switch, git checkout, and the three-tree updateBranching · intermediate · ~18 min
2. 02The branch lifecycle — listing, sorting, filtering, and auditing branchesBranching · intermediate · ~17 min
3. 03Divergence and shared history — the commit graph when two branches splitBranching · intermediate · ~19 min
4. 04Tracking and upstream — what `@{u}` means and how branches are linked to remotesBranching · intermediate · ~18 min
5. 05Branch naming and organization — patterns that signal intent to the teamBranching · intermediate · ~16 min
6. 06Branch deletion and recovery — git branch -d, git branch -D, and the reflog resurrection pathBranching · intermediate · ~22 min

1. 01Fast-forward merges — when a merge is just a pointer moveMerging · intermediate · ~20 min
2. 02Three-way merges — when fast-forward is not possibleMerging · intermediate · ~22 min
3. 03Merge commits and --no-ff — forcing topology for auditMerging · intermediate · ~22 min
4. 04The merge process — what Git actually does during a mergeMerging · intermediate · ~24 min
5. 05Aborting a merge — when to abort, and how the state is restoredMerging · intermediate · ~20 min
6. 06Merge strategies — recursive, resolve, octopus, ours, subtreeMerging · intermediate · ~24 min

1. 01When merges conflict — the three cases the algorithm cannot resolveConflicts · intermediate · ~20 min
2. 02The conflict markers — reading <<<<<<<, =======, and >>>>>>>Conflicts · intermediate · ~18 min
3. 03Resolving by hand — opening files, reading hunks, choosing sidesConflicts · intermediate · ~22 min
4. 04Resolving with tools — git mergetool, VS Code, and merge tool configurationConflicts · intermediate · ~22 min
5. 05IaC conflict examples — Terraform state, Ansible inventory, Kubernetes YAMLConflicts · intermediate · ~24 minLab
6. 06Conflict prevention — short branches, small commits, rerere, and the human layerConflicts · intermediate · ~20 min

1. 01What rebase does — replaying commits on a new baseFoundations · advanced · ~20 min
2. 02Rebase versus merge — when linear history is worth the rewriteFoundations · advanced · ~22 min
3. 03Interactive rebase — the editor interface and the six verbsInteractive Rebase · advanced · ~24 min
4. 04Rebase execution and stoppoints — when rebase pauses and how to resumeExecution · advanced · ~22 min
5. 05Autosquash and fixup — folding review-fixup commits automaticallyAutosquash · advanced · ~20 min
6. 06Shared history risks — why rewriting pushed commits is dangerousSafety · advanced · ~22 minLab

1. 01The merge versus rebase trade-off in detail — preservation versus rewriteFoundations · advanced · ~22 min
2. 02When to rebase — local branches, cleanup, and pre-merge replayFoundations · advanced · ~20 min
3. 03When to merge — shared branches, integrations, and release topologyFoundations · advanced · ~20 min
4. 04Team policy and consistency — why the team must pick one verb and stick to itPolicy · advanced · ~18 min
5. 05IaC and the merge-rebase question — Terraform state, configuration drift, and forced mergesIaC · advanced · ~22 min
6. 06The hybrid workflow — feature rebase, fast-forward into main, and trunk-based developmentPatterns · advanced · ~20 min

1. 01What cherry-pick does — replaying a single commit onto another branchFoundations · advanced · ~18 min
2. 02Cherry-pick conflicts — when the replay does not apply cleanlyConflicts · advanced · ~20 min
3. 03Backporting hotfixes — moving a fix without merging everythingBackporting · advanced · ~22 min
4. 04Cherry-picking multiple commits — ranges and batchesRanges · advanced · ~20 min
5. 05Cherry-pick versus merge — choosing between targeted and combined historyComparison · advanced · ~22 min
6. 06When not to cherry-pick — changes that must travel as a unitBoundaries · advanced · ~20 min

1. 01What revert does — producing a new commit that undoes a changeFoundations · advanced · ~18 min
2. 02Revert versus reset — additive undo versus history rewritingFoundations · advanced · ~20 min
3. 03Reverting a merge commit — `git revert -m 1 &lt;merge&gt;` and the mainline parentMergeReverts · advanced · ~22 min
4. 04Revert without committing — staging the inverse with `git revert -n`Foundations · advanced · ~18 min
5. 05Revert and the history audit trail — why every revert is visibleHistoryAudit · advanced · ~18 min
6. 06Revert versus redeploy — when to roll back, when to fix forwardOperations · advanced · ~22 min

1. 01Reset modes explained — --soft, --mixed, --hard, --merge, --keepModes · advanced · ~20 min
2. 02Soft reset — moving HEAD and keeping staged changesModes · advanced · ~18 min
3. 03Mixed reset — moving HEAD and resetting the indexModes · advanced · ~20 min
4. 04Hard reset — the destructive mode and when it is acceptableModes · advanced · ~22 min
5. 05Reset with file paths — `git reset &lt;commit&gt; -- &lt;path&gt;` and the reset-vs-restore distinctionModes · advanced · ~18 min
6. 06Reset safety and recovery — when not to use --hard, reflog-based recovery, --merge and --keepSafety · advanced · ~24 min

1. 01The Git 2.23 command split — why git checkout was overloaded and how switch and restore replaced itRestoreSwitch · intermediate · ~18 min
2. 02git switch in detail — branch switching, creation, detachment, and orphan branchesRestoreSwitch · intermediate · ~20 min
3. 03git restore in detail — restoring files from the index, from HEAD, and from any refRestoreSwitch · intermediate · ~20 min
4. 04Restore and the three trees — sources, destinations, and which combinations are validRestoreSwitch · intermediate · ~18 min
5. 05Switch versus checkout — when each is appropriate, behaviour differences, and the migration storyRestoreSwitch · intermediate · ~20 min
6. 06Migrating team habits — muscle memory, training, CI scripts, and what to update when migratingRestoreSwitch · intermediate · ~22 min

1. 01What the reflog records — every ref update, every time, with a reasonMechanics · advanced · ~20 min
2. 02Reflog locations and scopes — per-ref logs, the .git/logs tree, and enabling logging for tagsMechanics · advanced · ~18 min
3. 03Navigation with reflog — @{N}, @{date}, and using reflog as a history of HEADNavigation · advanced · ~22 min
4. 04Recovering from a hard reset — the precise reflog recipe and the boundaries of recoveryRecovery · advanced · ~22 min
5. 05Recovering from a bad rebase — reflog, ORIG_HEAD, and the cherry-pick recipeRecovery · advanced · ~22 min
6. 06Reflog expiry and gc — git reflog expire, gc.reflogExpire, and the choreography with garbage collectionExpiry · advanced · ~22 min

1. 01The recovery mindset — stop, inspect, locate, recoverRecovery · advanced · ~22 min
2. 02Recovering a deleted branch — the reflog is the recovery pathRecovery · advanced · ~24 minLab
3. 03Recovering a dropped stash — git stash list, the reflog, and the .git/logs/refs/stash fileRecovery · advanced · ~22 min
4. 04Recovering an amended commit — the previous commit is in the reflogRecovery · advanced · ~22 min
5. 05Recovering a commit after a shared rebase — the original is still in your local reflogRecovery · advanced · ~26 min
6. 06The recovery decision tree — a flowchart for any "I lost X" scenarioRecovery · advanced · ~26 min

1. 01Lightweight versus annotated tags — what each stores and why the audit trail differsTags and Releases · intermediate · ~18 min
2. 02Creating and listing tags — git tag, -a, -m, -d, -l with patterns, and git tag -nTags and Releases · intermediate · ~18 min
3. 03Tag pushing and fetching — why git push does not push tags by default, and what --tags and --follow-tags doTags and Releases · intermediate · ~18 min
4. 04Signed tags — git tag -s, git tag -u, and verification with git verify-tagTags and Releases · intermediate · ~20 min
5. 05Tag protection and releases — repository settings, release notes, and immutability via signingTags and Releases · intermediate · ~19 min
6. 06Release workflows — tag-on-merge, release branches, semantic versioning, release artefacts, and the deploy-after-tag patternTags and Releases · intermediate · ~22 min

1. 01What a remote is — a named pointer to another repositoryRemotes · intermediate · ~18 min
2. 02Adding and removing remotes — the lifecycle of a remote entryRemotes · intermediate · ~18 min
3. 03Remote-tracking branches — the local cache of remote stateRemotes · intermediate · ~18 min
4. 04Upstream relationships — the per-branch link to a remoteRemotes · intermediate · ~20 min
5. 05Multiple remotes — origin, upstream, and forks in one cloneRemotes · intermediate · ~20 min
6. 06Remote pruning and cleanup — keeping the local cache honestRemotes · intermediate · ~18 min

1. 01What fetch does — downloading remote state into the local cacheFetchVsPull · intermediate · ~18 min
2. 02What pull does — fetch plus merge (or fetch plus rebase)FetchVsPull · intermediate · ~18 min
3. 03git pull --rebase versus git pull --merge — linear history versus merge commitsFetchVsPull · intermediate · ~18 min
4. 04git pull --ff-only — refusing a pull that would require a mergeFetchVsPull · intermediate · ~16 min
5. 05Configuring pull to rebase by default — pull.rebase and branch.&lt;name&gt;.rebaseFetchVsPull · intermediate · ~18 min
6. 06The IaC and team pull policy — choosing one rule and enforcing itFetchVsPull · intermediate · ~22 min

1. 01What force push does — overwriting the remote tip with your local tipForcePush · advanced · ~18 min
2. 02The destructive default — what `git push --force` actually destroysForcePush · advanced · ~20 min
3. 03`git push --force-with-lease` — the safe force-pushForcePush · advanced · ~20 min
4. 04The reflog as safety net — what is recoverable after a force-pushForcePush · advanced · ~22 min
5. 05Branch protection and force-push — server-side enforcementForcePush · advanced · ~22 min
6. 06Force-push incident response — when a teammate has rewritten your workForcePush · advanced · ~22 min

1. 01What a worktree is — multiple working trees sharing one .git directoryWorktrees · advanced · ~20 min
2. 02Creating and removing worktrees — git worktree add, -b, --detach, --forceWorktrees · advanced · ~21 min
3. 03Multiple worktrees and shared git — how .git/ is sharedWorktrees · advanced · ~22 min
4. 04Worktrees and branches — same branch in two worktrees; detached HEADWorktrees · advanced · ~21 min
5. 05Infrastructure use cases — comparing IaC branches side by side; CI in a worktree; long-running checkoutsWorktrees · advanced · ~22 min
6. 06Worktree cleanup and pruning — git worktree prune; stale metadata; the lock fileWorktrees · advanced · ~22 min

1. 01What bisect does — binary search through commit history for the offending commitBisect · advanced · ~20 min
2. 02The binary search mental model — O(log n) and the step counts for typical historiesBisect · advanced · ~22 min
3. 03Automated bisect with `git bisect run` — exit codes, test scripts, and the shell wrapperBisect · advanced · ~24 min
4. 04Bisect log and visualize — recording, inspecting, and replaying a sessionBisect · advanced · ~18 min
5. 05Bisect and build artefacts — finding the commit that broke the buildBisect · advanced · ~22 min
6. 06Bisect pitfalls and recovery — flaky tests, dependencies, side effects, and `bisect reset`Bisect · advanced · ~22 minLab

1. 01What Git hooks are — scripts Git invokes at lifecycle eventsHooks · intermediate · ~20 min
2. 02Client-side hooks — where they live and how to enable themHooks · intermediate · ~20 min
3. 03Pre-commit and pre-push — the two most-used client-side hooksHooks · intermediate · ~22 min
4. 04Server-side hooks — pre-receive, update, post-receive, post-commitHooks · intermediate · ~20 min
5. 05Hooks and policy enforcement — the limits of client-side controlHooks · intermediate · ~22 min
6. 06Hooks and supply chain — secret scanning, dependency review, and the role of hooks versus CIHooks · intermediate · ~22 min

1. 01Config scopes — system, global, local, worktree, and where each value livesGitConfig · intermediate · ~18 min
2. 02User name and email identity — authorship, DCO, and why real identities matterGitConfig · intermediate · ~16 min
3. 03Aliases — what they are, what they cost, and which ones to keepGitConfig · intermediate · ~16 min
4. 04Include and conditional configs — one identity per repo, one set of aliases per teamGitConfig · intermediate · ~18 min
5. 05Credential helpers and secure storage — what each one stores, where, and at what riskGitConfig · intermediate · ~20 min
6. 06Signing configuration — keys, formats, and what production commits and tags should look likeGitConfig · intermediate · ~20 min

1. 01IaC repository types — single-tool versus multi-tool repositoriesRepoArch · advanced · ~22 min
2. 02Terraform repository layout — modules, environments, and root modulesRepoArch · advanced · ~24 min
3. 03Ansible repository layout — roles, playbooks, inventories, and group_varsRepoArch · advanced · ~24 min
4. 04Kubernetes repository layout — base plus per-environment, Kustomize versus HelmRepoArch · advanced · ~26 min
5. 05Network and policy repositories — separate repositories for network and policy configurationRepoArch · advanced · ~24 min
6. 06Documentation and runbook repositories — keeping docs in version control alongside codeRepoArch · advanced · ~22 min

1. 01The trade-off — coupling versus independence, and what a single commit can affectArchitecture · advanced · ~20 min
2. 02Monorepo architecture — one repository, many projectsArchitecture · advanced · ~24 min
3. 03Multi-repo architecture — one repository per service or projectArchitecture · advanced · ~23 min
4. 04Hybrid and middleware — polyglot repos, submodules, partial clones, and sparse-checkoutArchitecture · advanced · ~26 min
5. 05Ownership and access control — CODEOWNERS at the repository and directory levelArchitecture · advanced · ~24 min
6. 06The decision criteria — team size, coupling, CI performance, blast radius, security boundaries, and tool supportArchitecture · advanced · ~26 min

1. 01Trunk-based development — committing to the trunk every dayStrategies · advanced · ~22 min
2. 02Short-lived feature branches — small commits, frequent merges, and the rebase trade-offStrategies · advanced · ~20 min
3. 03Release branches — when stable releases matter and what maintenance costsStrategies · advanced · ~24 min
4. 04GitFlow contextually — what it is, when it fits, and why it does not fit modern CIStrategies · advanced · ~22 min
5. 05Environment branches — branch per environment and why it is an anti-pattern in GitOpsStrategies · advanced · ~26 min
6. 06The team-policy decision — choosing, documenting, enforcing, and changing the branching strategyPolicy · advanced · ~24 min

1. 01Pull request fundamentals — proposing, reviewing, mergingFundamentals · intermediate · ~18 min
2. 02The diff and the review — what reviewers look at and why small PRs matterReview · intermediate · ~22 min
3. 03Approvals and required reviewers — the gate, CODEOWNERS, and the auditApprovals · intermediate · ~21 min
4. 04Status checks — the automated gate and the cost of flakinessStatusChecks · intermediate · ~21 min
5. 05PR lifecycle and merge strategies — squash, merge commit, and rebaseLifecycle · intermediate · ~23 min
6. 06PR quality and best practices — templates, checklists, and the review contractQuality · intermediate · ~20 min

1. 01What CODEOWNERS is — a file in the repo that maps paths to ownersOwnership · advanced · ~19 min
2. 02Syntax and patterns — the line format, glob rules, and the order trapSyntax · advanced · ~21 min
3. 03Team and individual owners — @user, @org/team, and the security boundaryOwners · advanced · ~20 min
4. 04CODEOWNERS and required reviews — how forges turn ownership into a gateRequiredReviews · advanced · ~22 min
5. 05CODEOWNERS and bypass — who can override the rule and what is left behindBypass · advanced · ~20 min
6. 06CODEOWNERS as an operating system — composing ownership, branch protection, and status checksOperatingSystem · advanced · ~22 min

1. 01What branch protection is — server-side controls on a branchFoundations · advanced · ~20 min
2. 02Direct push restrictions — disallow direct writes, require pull requestsPushRestrictions · advanced · ~22 min
3. 03Required approvals and status checks — the merge-block conditionsMergeGates · advanced · ~24 minLab
4. 04Bypass and bypass actors — who can override the rule and what is left behindBypass · advanced · ~22 min
5. 05Tag protection — preventing tag deletion, restricting tag creation, enforcing signed tagsTagProtection · advanced · ~20 min
6. 06Protected branches and policy — branch protection as the enforcement layerPolicy · advanced · ~22 min

1. 01Why sign commits — the chain of trust and what signing actually provesSigningFoundations · advanced · ~22 min
2. 02GPG signing setup — generating a key, configuring Git, signing with -SGPGSigning · advanced · ~24 min
3. 03SSH signing setup — the Git 2.34+ approach using an existing SSH keySSHSigning · advanced · ~22 min
4. 04Signing tags versus commits — both can be signed; tags survive rebasesSigningTagsVsCommits · advanced · ~22 min
5. 05Verifying signatures — git verify-commit, git verify-tag, --show-signature, and forge UIsVerifyingSignatures · advanced · ~24 minLab
6. 06Signing policy and enforcement — branch protection, required signed commits, and the failure modesSigningPolicy · advanced · ~26 min

1. 01Authentication options — SSH vs HTTPS and the trade-offs that decideAuthentication · advanced · ~22 min
2. 02SSH keys and deploy keys — personal keys, deploy keys, host keys, and the read-only distinctionSSHKeys · advanced · ~24 min
3. 03HTTPS tokens and personal access tokens — PATs, fine-grained tokens, and OAuth appsHTTPSTokens · advanced · ~24 min
4. 04Credential storage and rotation — where the credential lives, how often it changes, and the leak surfaceCredentialStorage · advanced · ~26 min
5. 05The compromised account — what happens, what to do first, and how to contain the blastIncidentResponse · advanced · ~26 min
6. 06The least-privilege credential — scoping tokens to minimum scope, ephemeral credentials, and the principleLeastPrivilege · advanced · ~24 min

1. 01The secret leak fallacy — why deleting the file does not delete the secretMentalModel · advanced · ~22 min
2. 02Detection with secret scanning — gitleaks, truffleHog, and the CI gateDetection · advanced · ~24 minLab
3. 03The rotation response — rotate first, then clean history, the order that survives the incidentIncidentResponse · advanced · ~26 min
4. 04History cleanup tools — git filter-repo, BFG, and the limits of the rewriteRemediation · advanced · ~26 min
5. 05Forks, clones, and mirrors — the persistence of leaked secrets and the impossibility of perfect recallForensics · advanced · ~25 min
6. 06Prevention by design — pre-commit hooks, CI gates, and secrets that never reach the repositoryPrevention · advanced · ~28 min

1. 01git filter-repo — the modern replacement for git filter-branchTools · advanced · ~22 min
2. 02BFG Repo-Cleaner — the fast credential scrubberTools · advanced · ~22 min
3. 03Removing files from history — when a path must not existOperations · advanced · ~24 min
4. 04Replacing content — when a string must change across historyOperations · advanced · ~26 min
5. 05Re-signing after rewrite — restoring the chain of trustOperations · advanced · ~24 min
6. 06The force-push aftermath — communication, coordination, auditOperations · advanced · ~28 min

1. 01What CI is and is not — automation, not gatekeepingCI Fundamentals · foundation · ~18 min
2. 02The trigger to result pipeline — what fires a CI runCI Fundamentals · foundation · ~17 min
3. 03The runner and its environment — hosted, self-hosted, ephemeral, persistentCI Fundamentals · foundation · ~19 min
4. 04Jobs and steps — the units of work and how they relateCI Fundamentals · foundation · ~18 min
5. 05Status checkout — what gets reported back, and who reads itCI Fundamentals · foundation · ~17 min
6. 06CI versus the developer laptop — why "it works on my machine" is the bugCI Fundamentals · foundation · ~18 min

1. 01The three-plane model — control plane, runner, and environmentCI Architecture · foundation · ~20 min
2. 02Control plane isolation — why orchestration is separate from executionCI Architecture · foundation · ~22 min
3. 03Runner network and internet — egress controls, private runners, and the cloud-only caseCI Architecture · foundation · ~22 min
4. 04Jobs and concurrency — concurrency groups, cancel-in-progress, and queue limitsCI Architecture · foundation · ~22 min
5. 05Environment variables and config — secrets, env, vars, and the scopes that bind themCI Architecture · foundation · ~22 min
6. 06Artifacts, caches, and outputs — three distinct mechanisms for moving data through a jobCI Architecture · foundation · ~24 min

1. 01Pipeline as code — the workflow file is committedPipelines · intermediate · ~20 min
2. 02Stages and jobs — the two-level hierarchy and when each model appliesPipelines · intermediate · ~22 min
3. 03Job dependencies and DAG — needs, requires, dependencies, fan-in, fan-outPipelines · intermediate · ~22 minLab
4. 04Parallel execution and fan-out — matrix builds, the use case, and the costPipelines · intermediate · ~22 min
5. 05Pipeline status and observability — what the run page shows and how to read the logsPipelines · intermediate · ~20 min
6. 06Reusable workflows — DRY at the workflow level, what they enable, what they costPipelines · intermediate · ~22 min

1. 01Hosted runners — convenience, isolation, and the control you give upRunners · intermediate · ~18 min
2. 02Self-hosted runners — control, operational cost, and the security costRunners · intermediate · ~22 minLab
3. 03Ephemeral runners — clean state every job, and the cost of throwing away stateRunners · intermediate · ~20 min
4. 04Runner autoscaling and Actions Runner Controller — scaling on KubernetesRunners · advanced · ~24 min
5. 05Runner labels and selection — matching workflows to runners, and the trust modelRunners · intermediate · ~20 min
6. 06Runner tooling and actions — what is installed, GitHub-managed actions, and the marketplaceRunners · intermediate · ~21 min

1. 01The runner threat model — who attacks, how, and with what accessThreatModel · advanced · ~22 min
2. 02Arbitrary code execution — every CI run executes attacker-controlled code if the trigger is a PR from outsideCodeExecution · advanced · ~24 min
3. 03Production credentials on runners — why long-lived credentials on shared runners are catastrophicCredentials · advanced · ~23 min
4. 04The Docker socket risk — docker.sock mounted into a runner = root on the host; the escalation pathDockerSocket · advanced · ~26 min
5. 05Privileged containers and host mounts — what privileged means; the kernel surfacePrivilegedContainers · advanced · ~24 min
6. 06Persistence and lateral movement — what happens after the initial compromise; how to containPersistence · advanced · ~25 min

1. 01Secret variables fundamentals — how CI platforms store and serve secretsSecrets · advanced · ~20 min
2. 02Masking and its limits — what the log masker catches and what it does notSecrets · advanced · ~22 min
3. 03Log leakage risks — failure modes that bypass the maskerSecrets · advanced · ~23 min
4. 04Environment scopes — repository, environment, and organisation granularitySecrets · advanced · ~22 min
5. 05Secret rotation cadence — when to rotate, what triggers rotation, and the disciplineSecrets · advanced · ~22 min
6. 06The short-lived credential ideal — OIDC, dynamic secrets, and the end of long-lived keysSecrets · advanced · ~24 min

1. 01Why long-lived credentials fail — rotation cost, leak surface, blast radiusFoundations · advanced · ~24 min
2. 02OIDC federation basics — what OIDC is; the trust relationship between CI and cloudFoundations · advanced · ~26 min
3. 03GitHub Actions OIDC in practice — id-token: write permission; the JWT issuanceGitHub · advanced · ~25 min
4. 04OIDC in AWS — provider, audience, role, trust policy; aws-actions/configure-aws-credentialsAWS · advanced · ~28 min
5. 05OIDC in Azure and GCP — Workload Identity Federation; the federation poolAzureGCP · advanced · ~27 min
6. 06OIDC trust policy deep dive — sub claims, job_workflow_ref claims, the immutable subject claims changeTrustPolicy · advanced · ~28 minLab

1. 01What an artifact is — the output of a job, named and stored for laterFoundations · intermediate · ~18 min
2. 02Build outputs and binary artefacts — what gets uploaded, the upload limits, the retentionBuildOutputs · intermediate · ~20 min
3. 03Terraform plans as artifacts — the plan file as a review surface, plans across jobsTerraformPlans · intermediate · ~22 min
4. 04Reports and junit — test results, coverage, scan results as structured artifactsReports · intermediate · ~20 min
5. 05Images and manifests — OCI image artifacts, manifest artifacts, the production patternImagesAndManifests · intermediate · ~22 min
6. 06Artifact retention and storage — retention policies, the cost, the production rulesRetentionAndStorage · intermediate · ~20 min

1. 01The immutable identity principle — every artifact has a content-addressed identityFoundations · advanced · ~22 min
2. 02Digests and content-addressing — sha256:abc..., the artifact’s true nameContent Addressing · advanced · ~24 min
3. 03Promotion across environments — same artifact, different environmentsPromotion · advanced · ~23 min
4. 04The build versus rebuild trap — why rebuilding per environment destroys provenanceBuild Integrity · advanced · ~26 min
5. 05Immutable tags and digest pinning — why :latest is a contract that resolves to whoever pushes lastPinning · advanced · ~25 min
6. 06Provenance and the build identity — SLSA, attestations, and the chain from source to bytesProvenance · advanced · ~26 minLab

1. 01What a cache is — a content-addressed, key-matched, best-effort blob storeFoundations · intermediate · ~18 min
2. 02Cache versus artifact — best-effort acceleration versus durable recordFoundations · intermediate · ~20 min
3. 03actions/cache@v4 — inputs, behaviour, and a real workflowCaching mechanisms · intermediate · ~20 min
4. 04Cache keys and restore keys — exact match, prefix fallback, partial reuseCaching mechanisms · intermediate · ~20 min
5. 05Cache poisoning and staleness — the failure modes of trusting a cacheFailure modes · advanced · ~22 min
6. 06Cache cost and retention — what caches cost, how they are evicted, and when to delete themOperational hygiene · intermediate · ~22 min

1. 01The pipeline as a graph — why DAG, not stages, is the right mental modelFoundations · intermediate · ~20 min
2. 02needs and depends-on — declaring edges between jobsDeclaration · intermediate · ~20 min
3. 03Fan-in and fan-out — parallelism at job boundariesTopology · intermediate · ~20 min
4. 04Pipeline triggers and chains — workflow_run and workflow_callComposition · intermediate · ~20 min
5. 05Outputs as inputs — the typed contract between jobsDataflow · intermediate · ~20 min
6. 06Pipeline failure propagation — what happens when a dependency failsFailure modes · intermediate · ~22 min

1. 01Conditional fundamentals — when to skip, when to run, and the cost of always-runningGuards · intermediate · ~18 min
2. 02Branch and path filters — narrowing triggers by branch name and changed filesTriggers · intermediate · ~20 min
3. 03Tag and environment conditions — controlling which events touch which environmentsTriggers · intermediate · ~20 min
4. 04Expressions and context — `${ }`, `github.event`, `github.ref`, and the operatorsExpressions · intermediate · ~20 min
5. 05Matrix strategies — when a matrix is right, when it is overused, and the cardinality costExpansion · intermediate · ~20 min
6. 06Environment protection rules — required reviewers, wait timers, and branch restrictionsProtection · intermediate · ~21 min

1. 01The infrastructure pipeline pattern — eight stages from commit to auditInfrastructure CI · intermediate · ~22 minLab
2. 02Format stage — terraform fmt, ansible-lint format, kubeconformInfrastructure CI · intermediate · ~20 min
3. 03Lint and static analysis — tflint, ansible-lint, kubeconform, conftest, OPAInfrastructure CI · intermediate · ~24 min
4. 04Security scanning — tfsec, checkov, trivy, kics, snykInfrastructure CI · intermediate · ~26 min
5. 05Test and validate — terratest, Molecule, kyverno tests and the cost of testingInfrastructure CI · intermediate · ~24 min
6. 06Plan and review — terraform plan as the review artefact; the comment-on-PR patternInfrastructure CI · intermediate · ~22 min

1. 01The Terraform CI discipline — why plan-on-PR is the right patternFoundations · intermediate · ~24 min
2. 02fmt and validate — what Terraform built-ins catch and what they do notFormatAndValidate · intermediate · ~22 min
3. 03tflint and fmt deep — the .tflint.hcl ruleset and what fmt should have caughtLint · intermediate · ~26 min
4. 04tfsec and checkov — what security scanners actually check, and the false positive rateSecurityScanning · intermediate · ~28 min
5. 05Terratest and integration tests — Go-based testing of real infrastructureIntegrationTests · intermediate · ~26 min
6. 06Plan as artifact and PR comment — saving the plan, posting it, and the review contractPlanArtifact · intermediate · ~26 minLab

1. 01The Ansible CI discipline — what "tested" means for AnsibleFoundations · intermediate · ~24 min
2. 02YAML and playbook linting — yamllint and ansible-lint as the first gateFormatAndValidate · intermediate · ~22 min
3. 03ansible-lint and FQCN rules — fully qualified collection names as a conventionFormatAndValidate · intermediate · ~23 min
4. 04Ansible playbook syntax check — what --syntax-check proves and what it does notSyntaxCheck · intermediate · ~22 min
5. 05Molecule and integration testing — scenarios, drivers, and the verify stageMoleculeAndIntegration · intermediate · ~26 min
6. 06Staged validation and idempotency — check mode, diff mode, and the production patternStagedValidation · intermediate · ~26 minLab

1. 01The Kubernetes CI discipline — render, validate, packageFoundations · intermediate · ~24 min
2. 02Manifest validation with kubeconform — schemas, strict mode, version pinningManifestValidation · intermediate · ~24 minLab
3. 03Helm and Kustomize validation — lint, template, and buildTemplateValidation · intermediate · ~26 min
4. 04Policy with Conftest and Kyverno — Rego and CEL, and what policy catchesPolicy · intermediate · ~26 min
5. 05Security scanning with Trivy and Kubescape — vulnerabilities and misconfigurationsSecurityScanning · intermediate · ~24 min
6. 06Render and package as OCI — the artifact handoff to the GitOps controllerPackageAndPublish · intermediate · ~24 min

1. 01The container supply chain — source to registryContainer CI · intermediate · ~24 min
2. 02BuildKit and the build cacheContainer CI · intermediate · ~26 min
3. 03Multi-stage builds and distroless imagesContainer CI · intermediate · ~25 min
4. 04Image testing in CIContainer CI · intermediate · ~25 min
5. 05SBOM generation in CIContainer CI · intermediate · ~24 min
6. 06Image signing in CIContainer CI · intermediate · ~26 min

1. 01The testing pyramid for IaC — five layers and what each one costsTestingPyramid · advanced · ~26 min
2. 02Static checks and policy — the cheapest layer and what it catchesStaticAndPolicy · advanced · ~24 min
3. 03Unit and module tests — terraform test and Molecule in the pipelineUnitAndModule · advanced · ~25 min
4. 04Disposable integration tests — ephemeral environments and what they catchDisposableIntegration · advanced · ~26 min
5. 05Staging and production validation — the final layer and what it should catchStagingAndProd · advanced · ~24 min
6. 06The test strategy decision — choosing depth against the blast radiusTestStrategy · advanced · ~26 min

1. 01Continuous Delivery vs Continuous Deployment — the actual distinctionDefinitions · intermediate · ~19 min
2. 02Continuous integration recap — the foundation and its limitsCIRecap · intermediate · ~20 min
3. 03Continuous delivery requires approval — what the gate meansApprovalGate · intermediate · ~21 min
4. 04Continuous deployment — no approval, what that impliesNoApproval · intermediate · ~22 min
5. 05When deployment without approval fails — failure modes and incident classesFailureModes · intermediate · ~21 min
6. 06The decision framework — choosing between continuous delivery and continuous deploymentDecisionFramework · intermediate · ~20 min

1. 01Environments and promotion — the model and the boundaries between environmentsEnvironments · intermediate · ~20 min
2. 02Development environment — fast feedback and the failure modes that are acceptableDevelopment · intermediate · ~18 min
3. 03Test and staging environments — closer to production and the data questionTestAndStaging · intermediate · ~20 min
4. 04Production environment — the boundary and what production means in this courseProduction · intermediate · ~21 min
5. 05Identity isolation per environment — separate OIDC identities and the blast-radius disciplineIdentityIsolation · intermediate · ~22 min
6. 06Ephemeral and preview environments — per-PR environments and the costEphemeralEnvs · intermediate · ~20 min

1. 01When approval adds safety — the scenarios where a human checkpoint prevents real incidentsWhenApprovalHelps · intermediate · ~19 min
2. 02When approval adds bureaucracy — the scenarios where a gate is theatreWhenApprovalHarms · intermediate · ~18 min
3. 03Protected environments and required reviewers — the platform-side mechanism that enforces the gateProtectedEnvs · intermediate · ~21 min
4. 04Pull request approvals — N approvals, CODEOWNERS, dismiss stale, the auditPRApprovals · intermediate · ~20 min
5. 05Multi-party approval and segregation of duties — financial-grade controls and when they matterMultiParty · advanced · ~22 min
6. 06Approval fatigue and bypass risks — the failure mode and the warning signsFatigueAndBypass · advanced · ~21 min

1. 01The deployment pattern taxonomy — five patterns, four trade-off axesTaxonomy · intermediate · ~22 min
2. 02Rolling update — incremental replacement, surge and unavailabilityRollingUpdate · intermediate · ~21 min
3. 03Canary and progressive delivery — traffic splitting, metric-based promotionCanary · intermediate · ~26 min
4. 04Blue-green deployment — two environments, atomic switch, instant rollbackBlueGreen · intermediate · ~24 min
5. 05Recreate deployment — the downtime cost and the cases that justify itRecreate · intermediate · ~20 min
6. 06Choosing a strategy — the decision matrix and the production disciplineChoosing · intermediate · ~25 min

1. 01Rollback across artifact boundaries — the five mechanisms and what each can undoBoundaries · advanced · ~24 min
2. 02Application rollback — promoting the previous digest, the registry as the source of truthContainer · advanced · ~23 min
3. 03Kubernetes rollback via Deployment history — kubectl rollout undo and the revision modelKubernetes · advanced · ~22 min
4. 04Terraform rollback via state and applied — terraform state list and the targeted applyTerraform · advanced · ~25 min
5. 05Configuration management rollback — Ansible idempotency and the next-run restorationConfigMgmt · advanced · ~22 min
6. 06Database rollback and the data question — forward-fix vs backward-restore, the migration disciplineDatabase · advanced · ~26 min

1. 01The decision framework — what makes rollback safe and what makes forward-fix the only optionDecisionFramework · advanced · ~20 min
2. 02When rollback is the right answer — config regressions, deployment bugs, image issuesWhenRollback · advanced · ~18 min
3. 03When forward-fix is the right answer — schema migrations, breaking changes, data issuesWhenForwardFix · advanced · ~22 min
4. 04The decision cost and time — MTTR trade-offs and the production disciplineCostAndTime · advanced · ~20 min
5. 05Rollback and data integrity — when rollback cannot be undone and the cascading data effectsDataIntegrity · advanced · ~22 min
6. 06Post-rollback investigation — the audit trail, the fix-forward, and the lessonPostRollback · advanced · ~20 min

1. 01The failure types — flaky tests, real failures, infrastructure failures, race conditionsFailureClassification · intermediate · ~20 min
2. 02Retries and backoff — automatic retry vs manual retry, and the exponential backoff patternRetryPolicy · intermediate · ~21 min
3. 03Cleanup on failure — the cleanup path when a job fails midwayCleanupPath · intermediate · ~19 min
4. 04Partial deployment and resumability — when a deploy gets four of five changes donePartialDeploy · intermediate · ~22 min
5. 05Idempotency and the safe retry — why retry only works if the operation is idempotentIdempotency · advanced · ~21 min
6. 06The postmortem and the fix — from a failed pipeline to a fix-forwardPostmortem · advanced · ~22 min

1. 01Concurrent deployments and isolation — what "concurrent" means and the failure modesConcurrentDeploy · advanced · ~20 min
2. 02Environment locking and mutexes — concurrency groups, cancel-in-progress, and the implementationEnvLock · advanced · ~22 min
3. 03Terraform state locking — why state lock is mandatory; backend lock typesStateLock · advanced · ~24 min
4. 04Concurrency limits and throttling — runner concurrency, queue depth, and the queue effectThrottle · advanced · ~22 min
5. 05Queueing and serialization — when to serialise a deploy and the cost it carriesSerialize · advanced · ~22 min
6. 06The concurrency discipline — when to allow concurrency, when to prevent itDiscipline · advanced · ~22 min

1. 01The CI observability question — what gets measured, what doesn't, and the failure modesFoundations · intermediate · ~22 min
2. 02Queue and runtime metrics — what they reveal and the alert thresholds that matterRuntimeMetrics · intermediate · ~20 min
3. 03Success rate and flake rate — the distinction and how to interpret a 5% flake rateSuccessFlake · intermediate · ~22 min
4. 04Deployment frequency and lead time — the first pair of DORA metrics and what they meanDORA · intermediate · ~24 min
5. 05Change failure rate and MTTR — the second pair of DORA metrics and how to interpret themDORA · intermediate · ~22 min
6. 06Observability without employee ranking — the ethical boundary and what metrics actually measureEthics · intermediate · ~22 min

1. 01The audit chain — the six links between a commit and a running serviceFoundations · intermediate · ~22 min
2. 02The deployment claim — what the record asserts and what it omitsFoundations · intermediate · ~22 min
3. 03The change question — who, what, why, when, where, and howFoundations · intermediate · ~24 min
4. 04Deploy evidence and provenance — artefact identity and the chain to sourceProvenance · intermediate · ~24 minLab
5. 05The deployment receipt — what the audit-grade record containsReceipt · intermediate · ~24 min
6. 06Six months later — reconstruction as the test of an audit trailReconstruction · intermediate · ~24 min

1. 01The supply chain trust boundaries — six stages, each with a threat modelThreatModel · advanced · ~24 min
2. 02Source trust and repository attestation — branch protection, signed commits, the trust chainSourceTrust · advanced · ~26 min
3. 03Dependency trust and the attack surface — what is pulled in, what could be maliciousDependencyTrust · advanced · ~28 min
4. 04CI trust and the runner as an actor — the runner is an attacker if compromisedCITrust · advanced · ~26 min
5. 05Artifact trust and content-addressing — digests, signing, the registry as trust storeArtifactTrust · advanced · ~25 min
6. 06Deployment trust and the runtime boundary — what happens when an artifact reaches productionDeploymentTrust · advanced · ~27 min

1. 01Third-party actions are code — they execute on the runnerRisk · advanced · ~22 min
2. 02Mutable references and the tag-swap attackRisk · advanced · ~23 minLab
3. 03Compromised maintainers and the supply-chain attackRisk · advanced · ~25 min
4. 04Abandoned actions and the frozen actorRisk · advanced · ~22 min
5. 05Pinning to commit SHA — the only safe referenceDefence · advanced · ~26 min
6. 06Allowlisting and policy — controlling which actions are permittedDefence · advanced · ~26 min

1. 01The pinning discipline — why mutable references are a vulnerabilityDiscipline · advanced · ~24 min
2. 02Action and plugin pinning — GitHub Actions, GitLab CI, Jenkins pluginsCIPinning · advanced · ~26 min
3. 03Container image pinning — digests over tagsImagePinning · advanced · ~24 min
4. 04Terraform provider and module pinning — version constraints and the registry lockIacPinning · advanced · ~26 min
5. 05Ansible collection and role pinning — requirements.yml with version constraintsConfigPinning · advanced · ~24 min
6. 06Package pinning and lockfiles — npm shrinkwrap, pip-tools, go.sum, Cargo.lockPackageLockfiles · advanced · ~26 min

1. 01What an SBOM is — the bill of materials for softwareSBOMFoundations · intermediate · ~20 min
2. 02SPDX and CycloneDX — the two formats, the trade-offs, the toolingFormats · intermediate · ~22 min
3. 03SBOM generation in CI — syft, cyclonedx-bom, cdxgenGeneration · intermediate · ~24 min
4. 04SBOM distribution and attestation — SBOM as an in-toto attestationDistribution · intermediate · ~22 min
5. 05Vulnerability matching against SBOMs — VEX, Grype, TrivyVulnerabilityMatching · intermediate · ~22 min
6. 06SBOM as an operational input — incident response, license audit, dependency changeOperationalization · intermediate · ~22 minLab

1. 01Why sign artifacts — the supply chain integrity argumentFoundations · advanced · ~22 min
2. 02Cosign and the Sigstack — what cosign does, the broader Sigstore ecosystemSigstore · advanced · ~24 min
3. 03Keyless signing with Fulcio — OIDC-issued ephemeral keysKeyless · advanced · ~26 min
4. 04Self-managed keys and KMS — when to use your own keys, KMS integrationKeypair · advanced · ~26 min
5. 05Rekor and the transparency log — what Rekor does, the public logTransparency · advanced · ~24 min
6. 06Verify on deploy — the cluster admission controller, policy-controllerVerification · advanced · ~26 min

1. 01What provenance is — the attestation of where an artifact came fromFoundations · advanced · ~22 min
2. 02SLSA build levels — L0 through L3 and what each level guaranteesBuildTrack · advanced · ~24 min
3. 03in-toto attestations — the standard format and predicate typesEnvelopes · advanced · ~22 min
4. 04SLSA source track — source control integrity and the producer side of provenanceSourceTrack · advanced · ~24 min
5. 05GitHub Actions artifact attestations — actions/attest and the platform-native provenanceGitHub · advanced · ~26 min
6. 06Consuming and verifying attestations — the verifier side and the policyVerify · advanced · ~24 min

1. 01The CI/CD threat model — who attacks, what they want, how they get inThreatModel · advanced · ~24 min
2. 02The malicious commit attack — the insider or compromised PR scenarioAttack · advanced · ~24 min
3. 03The account-compromise attack — the stolen-credentials scenarioAttack · advanced · ~25 min
4. 04The dependency-compromise attack — the upstream-package scenarioAttack · advanced · ~25 min
5. 05The runner-compromise attack — the persistent-access scenarioAttack · advanced · ~25 min
6. 06The secret-leak and registry-compromise attack — credential-exfiltration scenariosAttack · advanced · ~25 min

1. 01The GitOps principles — declarative, versioned, pulled, reconciledFoundations · foundation · ~18 min
2. 02Declarative desired state — describing what should be, not how to get thereFoundations · foundation · ~17 min
3. 03Versioned and immutable — Git as the canonical record of desired stateFoundations · foundation · ~18 min
4. 04Pulled automatically — the controller reaches out to GitFoundations · foundation · ~18 min
5. 05Continuously reconciled — observed versus desired, and the loopFoundations · foundation · ~19 min
6. 06GitOps versus traditional CD — the push model, the pull model, and the trust differenceFoundations · foundation · ~20 min

1. 01The push model — CI holds credentials and reaches out to the clusterFoundations · advanced · ~20 min
2. 02The pull model — a controller inside the cluster reaches out to GitFoundations · advanced · ~20 min
3. 03Credential boundaries — where the secrets live in each modelSecurity · advanced · ~22 min
4. 04Blast radius — what a CI compromise affects, what a controller compromise affectsSecurity · advanced · ~22 min
5. 05Hybrid architectures — when neither the pure push nor the pure pull model fitsPatterns · advanced · ~22 min
6. 06The trust decision — choosing the right model for your organisationDecision · advanced · ~22 min

1. 01The reconciliation loop — observed, desired, difference, actionMechanics · advanced · ~22 min
2. 02Observed versus desired — what "actual" and "what should be" meanMechanics · advanced · ~21 min
3. 03Reconciliation intervals — how often, and the trade-offsMechanics · advanced · ~23 min
4. 04Argo CD reconciliation mechanics — the three components, the cache, the diffTools · advanced · ~23 min
5. 05Flux reconciliation mechanics — GitRepository, Kustomization, the source controllerTools · advanced · ~24 min
6. 06Failure modes in reconciliation — what stops the loop, and how to detect itReliability · advanced · ~24 minLab

1. 01What drift is — the actual diverging from the desiredDrift · advanced · ~22 min
2. 02Manual drift — the operator edits the cluster directlyDrift · advanced · ~21 min
3. 03Accidental drift — controllers, schedulers, and side effectsDrift · advanced · ~23 min
4. 04Emergency drift — when incident response breaks the modelDrift · advanced · ~24 min
5. 05Drift detection and alerting — what metrics show drift and what the alerts look likeDrift · advanced · ~22 minLab
6. 06Self-heal versus control — when automatic reconciliation fights the operatorDrift · advanced · ~24 min

1. 01Application versus environment repositories — the two-repo patternRepo Models · advanced · ~22 min
2. 02Monorepo with overlays — Kustomize and Helm values in one treeRepo Models · advanced · ~24 min
3. 03Multi-repo per environment — dev, staging, prod each their own repoRepo Models · advanced · ~23 min
4. 04Source Hydrator and the mirror — Argo CD sources that are not the application repoHydration · advanced · ~24 min
5. 05Promotion models — promote the immutable artifact vs promote the Git refPromotion · advanced · ~23 min
6. 06The architecture decision — when each model fitsDecision · advanced · ~23 min

1. 01Argo CD architecture — the three components and the data flowArchitecture · advanced · ~26 minLab
2. 02The Application CRD — source, destination, sync, and the resource modelCRD · advanced · ~25 min
3. 03Source types and Helm/Kustomize — directory, repo, helm, kustomize, pluginSources · advanced · ~27 min
4. 04Sync policies and sync windows — automated, manual, prune, and the time-bound gateSync · advanced · ~28 min
5. 05Projects and RBAC — the multi-tenant boundary and the policy CSVMultitenancy · advanced · ~27 min
6. 06ApplicationSet and cluster generation — one resource, many ApplicationsApplicationSet · advanced · ~28 min

1. 01The Flux architecture — the toolkit composition and the controller modelArchitecture · advanced · ~26 min
2. 02GitRepository and source-controller — the source of desired stateSource · advanced · ~25 min
3. 03Kustomization controller — reconciling Kustomize manifests into the clusterKustomize · advanced · ~27 min
4. 04HelmRelease controller — reconciling Helm charts with versioned valuesHelm · advanced · ~27 min
5. 05Image automation and update — scanning registries, filtering tags, writing back to GitImage · advanced · ~26 min
6. 06Notification controller and webhooks — the alerting layerNotification · advanced · ~25 min

1. 01Manual sync — the default, the audit, and the discipline of waitingSyncStrategies · advanced · ~22 min
2. 02Automated sync — the convenience and the controls it requiresSyncStrategies · advanced · ~24 min
3. 03Self-heal — when automatic correction is right and when it is wrongSyncStrategies · advanced · ~23 min
4. 04Prune and the blast radius — what prune deletes and the safety disciplineSyncStrategies · advanced · ~26 min
5. 05Sync waves and phasing — ordering, dependencies, and the wave annotationSyncStrategies · advanced · ~25 min
6. 06Replace, force, and server-side apply — the options and their consequencesSyncStrategies · advanced · ~25 min

1. 01What prune is — Git desired state deletes cluster actualGitOpsPruning · advanced · ~22 min
2. 02Prune versus orphan — the two failure modes for absent manifestsGitOpsPruning · advanced · ~24 min
3. 03Orphaned resources and the cluster — what survives when the manifest disappearsGitOpsPruning · advanced · ~25 min
4. 04Prune safety mechanisms — dry-run, sandbox clusters, and the escape hatchGitOpsPruning · advanced · ~23 min
5. 05Incident — a prune deleted production — the recovery procedureGitOpsPruning · advanced · ~26 min
6. 06Prune policy decision framework — when to allow prune, when to forbid itGitOpsPruning · advanced · ~24 min

1. 01What Synced means — desired state matches actual stateSyncedVsHealthy · advanced · ~20 min
2. 02What Healthy means — the workload is functioning correctlySyncedVsHealthy · advanced · ~21 min
3. 03The Synced and Healthy matrix — four combinationsSyncedVsHealthy · advanced · ~22 min
4. 04Progressing and Degraded states — the intermediate statesSyncedVsHealthy · advanced · ~19 min
5. 05The 3 AM test — what tells you the workload is broken when the dashboard is greenSyncedVsHealthy · advanced · ~22 min
6. 06When Synced is not Healthy — the failure modes the platform does not catchSyncedVsHealthy · advanced · ~22 min

1. 01The GitOps secret problem — why plaintext credentials cannot live in GitMentalModel · advanced · ~22 min
2. 02External secret systems — Vault, cloud KMS, and the controller that bridges themExternalSystems · advanced · ~24 min
3. 03Encrypted Git workflows — encrypt the value, leave the keys elsewhereEncryptedAtRest · advanced · ~23 min
4. 04Bitnami Sealed Secrets — cluster-bound encryption and the controller as the trust boundaryEncryptedAtRest · advanced · ~25 min
5. 05SOPS and Mozilla SOPS — file-level encryption for the GitOps repositoryEncryptedAtRest · advanced · ~26 min
6. 06The secret reference pattern — what goes in Git, what never shouldReferencePattern · advanced · ~22 min

1. 01The GitOps RBAC model — repository, controller, and cluster as three layersRBACModel · advanced · ~24 min
2. 02Repository permissions — the merge is the deployRepositoryLayer · advanced · ~23 min
3. 03Controller cluster permissions — what the reconciler is allowed to doControllerLayer · advanced · ~26 min
4. 04Argo CD RBAC in detail — projects, policy rows, and the Casbin modelArgoCDRBAC · advanced · ~26 min
5. 05Flux multi-tenancy — lockdown flags and the per-namespace modelFluxTenancy · advanced · ~25 min
6. 06Environment boundaries — dev, staging, and production as separate concernsEnvironmentBoundaries · advanced · ~24 min

1. 01Promotion by artifact — the same digest moves through environmentsPromotion models · advanced · ~23 min
2. 02Promotion by Git ref — the Git reference moves; the artefact is built per environmentPromotion models · advanced · ~24 min
3. 03Promotion by environment repo — each environment has its own Git statePromotion models · advanced · ~24 min
4. 04Promotion by ApplicationSet — programmatic generation of promotion targetsPromotion models · advanced · ~25 min
5. 05Promotion windows and approvals — the time-bound gatesPromotion controls · advanced · ~26 min
6. 06The promotion decision — which model fits which organisationPromotion decision · advanced · ~26 min

1. 01Git revert versus controller rollback — what Git undoes and what the controller undoesFoundations · advanced · ~22 min
2. 02Data rollback versus state rollback — the two meanings of "rollback" for an infrastructure changeDefinitions · advanced · ~24 min
3. 03Argo CD rollback and history — `argocd app rollback`, `argocd app history`, and the rollback UIArgoCD · advanced · ~22 min
4. 04Flux rollback via revert — `git revert` plus reconcile, and the workflow the controller followsFlux · advanced · ~24 min
5. 05The rollback decision framework — when to revert Git, when to deploy a hotfix, when to forward-fixDecisionFramework · advanced · ~24 min
6. 05The rollback decision framework — when to revert Git, when to deploy a hotfix, when to forward-fixDecisionFramework · advanced · ~24 min
7. 06Post-rollback investigation — the audit trail, the fix-forward, and the lesson that closes the loopPostRollback · advanced · ~22 minLab

1. 01Repository unavailable — what happens when Git is downDetection · advanced · ~22 min
2. 02Authentication failure — token expired, key rotatedDetection · advanced · ~23 min
3. 03Controller unavailable — the GitOps control plane is downDetection · advanced · ~25 minLab
4. 04Bad manifests — the controller refuses to applyDetection · advanced · ~26 min
5. 05Unhealthy deployment — synced but brokenDetection · advanced · ~25 min
6. 06Secret dependency failure — External Secrets Operator cannot reach VaultDetection · advanced · ~26 min

1. 01The incident versus GitOps tension — when the model fights the responderFoundations · advanced · ~22 min
2. 02Break-glass procedures — the discipline of breaking the model on purposeBreakGlass · advanced · ~24 minLab
3. 03Disabling self-heal — how, who, and for how longSelfHeal · advanced · ~26 min
4. 04Post-incident Git reconciliation — the manual change must enter GitReconciliation · advanced · ~24 min
5. 05The postmortem and the policy update — what changes after the incidentPostmortem · advanced · ~25 min
6. 06Pragmatism versus purity — when GitOps can waitPragmatism · advanced · ~23 min

1. 01What infrastructure GitOps is — Terraform, Pulumi, and reconciliationFoundations · advanced · ~24 min
2. 02Terraform and GitOps with Atlantis — pull-request-driven plan and applyFoundations · advanced · ~26 min
3. 03Terraform and the Argo CD application controller — manifests as Git stateFoundations · advanced · ~24 min
4. 04Pulumi and Kubernetes GitOps — the Kubernetes operator patternFoundations · advanced · ~24 min
5. 05Network and firewall GitOps — when the tooling supports itFoundations · advanced · ~24 min
6. 06The infrastructure GitOps limitations — state, drift, secretsFoundations · advanced · ~26 min

1. 01MFA and account security — the first line of repository defenceRepoSecurity · advanced · ~22 min
2. 02Access control and the principle of least privilegeRepoSecurity · advanced · ~24 min
3. 03Branch protection deep dive — the full set of optionsRepoSecurity · advanced · ~26 min
4. 04Required status checks — what runs and what must passRepoSecurity · advanced · ~24 min
5. 05Secret scanning and push protection — native controls and gitleaksRepoSecurity · advanced · ~25 min
6. 06Repository audit and monitoring — who changed what, whenRepoSecurity · advanced · ~26 min

1. 01What the CI platform can touch — the blast radius of a CI compromiseBlastRadius · advanced · ~22 min
2. 02Cloud access from CI — what cloud credentials doCloudAccess · advanced · ~22 min
3. 03Kubernetes access from CI — what cluster credentials doClusterAccess · advanced · ~23 min
4. 04Terraform state access from CI — what state access enablesStateAccess · advanced · ~23 min
5. 05Registry and secret store access from CI — what registry and secret-store creds enableRegistryAndSecrets · advanced · ~25 min
6. 06Production network access from CI — the production boundaryProductionBoundary · advanced · ~26 min

1. 01The validation versus deployment identity — two identities, two boundariesIdentities · advanced · ~24 min
2. 02Scoped IAM roles — what each role can do; the smallest setCloudIAM · advanced · ~26 min
3. 03Scoped Kubernetes RBAC — ServiceAccounts, Roles, RoleBindingsClusterRBAC · advanced · ~25 min
4. 04Ephemeral per-job credentials — OIDC short-lived tokensEphemeralCredentials · advanced · ~26 min
5. 05Least privilege in GitOps — what the controller can do; what it cannotGitOpsRBAC · advanced · ~24 min
6. 06The least-privilege decision — what to lock down firstPrioritisation · advanced · ~23 min

1. 01The protected environment pattern — the platform-side guard for production deploysPattern · advanced · ~24 min
2. 02Required reviewers and the wait timer — the human gate that buys the team five minutesReviewers · advanced · ~25 min
3. 03Environment secrets and isolation — secrets scoped to a deployment targetSecrets · advanced · ~24 min
4. 04Deployment branch restriction — only the right source can deploy to productionBranches · advanced · ~23 min
5. 05Bypass and bypass actors — the role-based exceptions that weaken the gateBypass · advanced · ~26 min
6. 06Environment policy as code — terraform-github-actions and terraform-gitlab-providerAsCode · advanced · ~25 min

1. 01Why rotate credentials — the cost of long-lived secretsFoundations · advanced · ~24 min
2. 02Deploy keys and SSH key rotation — the lifecycle of a read/write credential for a Git remoteDeployKeys · advanced · ~25 minLab
3. 03Token rotation cadence — PAT, OAuth, and OIDC tokensTokenRotation · advanced · ~24 min
4. 04Cloud credential rotation — IAM access keys and OIDC federationCloudCredentials · advanced · ~26 min
5. 05Registry credential rotation — push and pull credentialsRegistryCredentials · advanced · ~22 min
6. 06GitOps controller credential rotation — the controller's repository and cluster accessControllerCredentials · advanced · ~25 minLab

1. 01The incident arrives — first alert, first scope, first ten minutesIncidentResponse · advanced · ~24 min
2. 02Revoke or rotate first — the first action and the rationale that forces itIncidentResponse · advanced · ~28 min
3. 03Assess exposure — who had access and what was used in the windowIncidentResponse · advanced · ~26 min
4. 04Inspect usage — log analysis and the timeline that survives the auditIncidentResponse · advanced · ~26 min
5. 05Remove repository exposure — history cleanup with filter-repoIncidentResponse · advanced · ~28 min
6. 06Prevent recurrence — the controls that should have caught itIncidentResponse · advanced · ~28 min

1. 01The runner incident arrives — detection, initial scope, first ten minutesIncidentResponse · advanced · ~24 min
2. 02Isolate the runner — remove from pool, drain new jobs, preserve evidenceIncidentResponse · advanced · ~28 min
3. 03Revoke credentials — what credentials did the runner have, and how to revoke themIncidentResponse · advanced · ~26 min
4. 04Determine artifact impact — what artifacts did the runner produce, and which are suspectIncidentResponse · advanced · ~26 min
5. 05Invalidate and rebuild — the rebuild from clean source, on a clean runnerIncidentResponse · advanced · ~28 min
6. 06Prevent recurrence — ephemeral runners, network isolation, attestation per jobIncidentResponse · advanced · ~28 min

1. 01The supply-chain incident arrives — detection and initial triageIncidentResponse · advanced · ~26 min
2. 02Stop affected builds — pause CI and pin to known-goodIncidentResponse · advanced · ~28 min
3. 03Identify impacted artifacts — what used the bad versionIncidentResponse · advanced · ~26 min
4. 04Rotate credentials and revoke tokens — what the malicious code touchedIncidentResponse · advanced · ~26 min
5. 05Rebuild trusted artifacts — clean source, pinned versionsIncidentResponse · advanced · ~28 min
6. 06Improve dependency controls — lockfile enforcement, scan-on-PRIncidentResponse · advanced · ~28 min

1. 01The CI/CD DR question — what fails, what survives, what to rebuildDisasterRecovery · advanced · ~24 min
2. 02Recovering the control plane — hosted service versus self-hostedDisasterRecovery · advanced · ~26 min
3. 03Recovering runners — the rebuild plan; the registration tokensDisasterRecovery · advanced · ~26 min
4. 04Recovering secrets — the secret store; the rotationDisasterRecovery · advanced · ~24 min
5. 05Recovering the artifact registry — the backup planDisasterRecovery · advanced · ~22 min
6. 06The disaster recovery drill — the quarterly rehearsalDisasterRecovery · advanced · ~24 min

1. 01The Git hosting failure scenario — what happens when the platform is downGitHostingFail · advanced · ~24 min
2. 02Multi-remote failover — two remotes, automatic failoverGitHostingFail · advanced · ~25 min
3. 03Mirror repositories and CDN — the read-only fallbackGitHostingFail · advanced · ~26 min
4. 04Local bare repository fallback — the last resortGitHostingFail · advanced · ~24 min
5. 05Self-hosted Git as fallback — Gitea, GitLab CEGitHostingFail · advanced · ~26 min
6. 06Recovery time objectives — what RTO is acceptable for a Git hosting failureGitHostingFail · advanced · ~26 min
7. 07Self-hosted forge and CI control-plane lifecycleSelf-hosted platform operations · advanced · ~30 min

1. 01The registry failure scenario — when pulls return 503 and the deploy falls overRegistryFail · advanced · ~24 minLab
2. 02Impact on deployment — what stops working, what keeps workingRegistryFail · advanced · ~24 min
3. 03Registry replication — the multi-region strategyRegistryFail · advanced · ~26 min
4. 04Immutable tag fallback — when :latest is the only optionRegistryFail · advanced · ~24 min
5. 05Registry monitoring and alerting — the metrics that matterRegistryFail · advanced · ~26 min
6. 06The registry drill — the quarterly rehearsalRegistryFail · advanced · ~26 min

1. 01Runner pool sizing — the workload model and the concurrency limitSizing · advanced · ~22 min
2. 02Queueing and wait times — what happens when jobs exceed capacitySizing · advanced · ~22 min
3. 03Ephemeral runner sizing — per-job cost and the speed-versus-money trade-offSizing · advanced · ~22 min
4. 04Runner autoscaling with ARC — Kubernetes-based scale to zeroAutoscaling · advanced · ~24 min
5. 05Cost of hosted versus self-hosted runners — the financial trade-offCost · advanced · ~22 min
6. 06The capacity plan — the document that turns numbers into a budgetPlan · advanced · ~24 min

1. 01Measure before optimising — the metrics and the baselineMeasure · intermediate · ~22 min
2. 02Cache and sharding — the two levers for pipeline durationLevers · intermediate · ~22 min
3. 03Parallelism and matrix — fan-out, fan-in, and the trade-offsParallelism · intermediate · ~24 min
4. 04Artifact and layer caching — Docker layer cache and build cacheBuild cache · intermediate · ~23 min
5. 05Skip when nothing changed — path filters and conditional executionSkip rules · intermediate · ~22 min
6. 06The performance loop — measure, optimise, re-measureThe loop · intermediate · ~22 min

1. 01The large repository problem — clone, fetch, and checkout at scaleFoundations · intermediate · ~18 min
2. 02Binaries and large files — what does not belong in GitBoundaries · intermediate · ~18 min
3. 03Git LFS fundamentals — pointers and object storageLFS · intermediate · ~20 min
4. 04Shallow clones and partial checkouts — fetching less historyShallowAndPartial · intermediate · ~20 min
5. 05Sparse-checkout and filter — only what you needSparse · intermediate · ~22 min
6. 06Repository design discipline — prevention versus cureDiscipline · intermediate · ~22 min

1. 01Committed secrets in IaC — credentials that should never reach GitAntiPatterns · intermediate · ~24 min
2. 02Terraform state in Git — the file that does not belong in the repositoryAntiPatterns · intermediate · ~26 min
3. 03Generated files in the repository — why build output does not belong in GitAntiPatterns · intermediate · ~22 min
4. 04No ownership or CODEOWNERS — the repository without a reviewer mapAntiPatterns · intermediate · ~24 min
5. 05Direct production pushes — bypassing the merge gateAntiPatterns · intermediate · ~25 min
6. 06Mutable dependencies and loose tags — the tag that is not a contractAntiPatterns · intermediate · ~26 min

1. 01Permanent privileged runners — long-lived self-hosted runners with standing credentialsRunnerHardening · intermediate · ~22 min
2. 02Secrets in logs — why masking is not enoughLoggingHygiene · intermediate · ~22 min
3. 03Mutable dependencies — the floating-tag contractDependencyPinning · intermediate · ~23 min
4. 04No artifact identity — relying on tags instead of digestsArtifactIdentity · intermediate · ~25 min
5. 05Rebuilding per environment — why promotion, not re-buildPromotion · intermediate · ~24 min
6. 06Unsafe auto-apply — auto-merge without guardrailsAutoApply · intermediate · ~26 min

1. 01Cluster-admin everywhere — the controller holds the keys to the clusterControllerPrivilege · advanced · ~24 min
2. 02Unsafe prune — automated deletion without a diff, a sandbox, or an opt-outUnsafePrune · advanced · ~24 min
3. 03Plaintext secrets in Git — the secrets that the repository remembersPlaintextSecrets · advanced · ~24 min
4. 04Uncontrolled drift — when the cluster forgets GitUncontrolledDrift · advanced · ~24 min
5. 05No environment separation — one controller, one repo, every clusterEnvironmentSeparation · advanced · ~26 min
6. 06The GitOps discipline — the synthesisSynthesis · advanced · ~26 min

1. 01The change question — six questions a change must answer before it is appliedTheQuestion · intermediate · ~22 min
2. 02The change record — the artefact that survives the changeTheRecord · intermediate · ~24 min
3. 03The change author and approver — the human links in the audit chainRoles · intermediate · ~25 min
4. 04The change rollback plan — what we do when the change goes wrongRollback · intermediate · ~26 min
5. 05The change communication — who needs to know, when, and howComms · intermediate · ~24 min
6. 06The change postmortem — what we learned and what we change nextPostmortem · intermediate · ~26 min

1. 01The reference architecture — the diagram and the componentsArchitecture · advanced · ~24 min
2. 02The trust boundaries — where the system trusts and does notBoundaries · advanced · ~25 min
3. 03The identity flow — from engineer to commit to productionIdentity · advanced · ~26 min
4. 04The artifact flow — from source to image to deploymentArtifact · advanced · ~26 min
5. 05The deployment flow — from plan to apply to runtimeDeployment · advanced · ~26 min
6. 06The observability flow — what we see and what we do notObservability · advanced · ~25 min

1. 01The IaC tooling landscape — Terraform, Ansible, Kubernetes, Docker, and the boundariesOverview · advanced · ~26 min
2. 02Terraform in the pipeline — plan as artefact, apply as gateTerraform · advanced · ~28 min
3. 03Ansible in the pipeline — the role, the limits, the dry-runAnsible · advanced · ~26 min
4. 04Kubernetes in the pipeline — manifest validation and the GitOps syncKubernetes · advanced · ~28 min
5. 05Docker and OCI in the pipeline — the container build and the registryDocker · advanced · ~26 min
6. 06Network IaC in the pipeline — the missing pieceNetwork · advanced · ~24 min

1. 01The Terraform delivery pipeline — an end-to-end viewPipelineShape · advanced · ~26 min
2. 02fmt and validate in CI — the cheapest checksFormatAndValidate · advanced · ~24 min
3. 03tflint and fmt-deep in CI — the lint layerLintLayer · advanced · ~25 min
4. 04tfsec and checkov in CI — the security layerSecurityLayer · advanced · ~28 min
5. 05Plan as an artifact — the review surfacePlanArtifact · advanced · ~27 min
6. 06Apply and drift detection — the production boundaryApplyAndDrift · advanced · ~28 min

1. 01The Ansible delivery pipeline — an end-to-end viewPipelineShape · advanced · ~28 min
2. 02YAML and lint in CI — yamllint and ansible-lint as the first gatesLint · advanced · ~26 min
3. 03Syntax check and Molecule — the static and dynamic checkSyntaxAndTest · advanced · ~28 min
4. 04Staged validation environments — dev, staging, prodEnvironments · advanced · ~26 min
5. 05Idempotency and change detection — the production disciplineIdempotency · advanced · ~28 min
6. 06Secrets and runtime variables — the safe-handling patternSecrets · advanced · ~28 min

1. 01The Kubernetes delivery pipeline — an end-to-end viewPipelineShape · advanced · ~26 min
2. 02Manifest render and validate — the CI side of the pipelineCIRenderValidate · advanced · ~27 min
3. 03Helm or Kustomize build — the packaging decisionPackaging · advanced · ~25 min
4. 04Container image build and push — the immutable artefactImageArtifact · advanced · ~28 min
5. 05GitOps sync and reconcile — the production entry pointGitOpsSync · advanced · ~27 min
6. 06The CD loop closing — observability and feedbackObservabilityFeedback · advanced · ~24 min

1. 01The container delivery pipeline — end-to-end viewPipelineShape · advanced · ~26 min
2. 02Source to test — lint, unit, integrationSourceToTest · advanced · ~26 min
3. 03Build and OCI image — BuildKit, multi-stageBuildAndOCI · advanced · ~28 min
4. 04SBOM and vulnerability scan — syft and trivySBOMAndScan · advanced · ~27 min
5. 05Sign and verify — cosign and the policySignAndVerify · advanced · ~26 min
6. 06Registry and deploy — the artefact goes homeRegistryAndDeploy · advanced · ~27 min

1. 01Observability as deployment marker — the change-cause annotationChangeCause · intermediate · ~24 min
2. 02Deploy events and correlation — the timeline viewCorrelation · intermediate · ~24 min
3. 03Performance change detection — did the deploy cause the regressionPerfDetect · intermediate · ~26 min
4. 04Error rate and deploys — the deploy-to-error graphErrorRate · intermediate · ~24 min
5. 05Audit logs from the pipeline — who did whatAudit · intermediate · ~24 min
6. 06The observability of observability — meta-monitoringMetaMonitor · intermediate · ~26 min

1. 01The deployment marker pattern — leaving a trailPattern · intermediate · ~22 min
2. 02The change-cause annotation — the kubectl annotation and the OpenTelemetry attributeChangeCause · intermediate · ~24 min
3. 03Deploy timestamp and version labels — the runtime identityRuntimeIdentity · intermediate · ~24 min
4. 04The deploy event log — the platform-side auditAuditLog · intermediate · ~25 min
5. 05Correlation with metrics and logs — the joined queryCorrelation · intermediate · ~26 min
6. 06The 3 AM incident and the deploy marker — the real testRealTest · intermediate · ~26 min

1. 01The application and platform split — who owns whatFoundations · intermediate · ~24 min
2. 02The infrastructure team role — the boundariesInfraRole · intermediate · ~24 min
3. 03The platform team role — the shared capabilityPlatformRole · intermediate · ~25 min
4. 04The security team role — the advisory and auditSecurityRole · intermediate · ~25 min
5. 05The reviewer and approver role — the human gateReviewerRole · intermediate · ~25 min
6. 06The shared responsibility model — the synthesisSharedModel · intermediate · ~26 min

1. 01The control versus the bureaucracy — the trade-offControls · advanced · ~22 min
2. 02Structural versus procedural controls — the differenceControls · advanced · ~24 min
3. 03Policy as code — OPA, Conftest, and KyvernoPolicyAsCode · advanced · ~26 min
4. 04Shifted-left controls — catching at PR time, not deploy timeShiftLeft · advanced · ~24 min
5. 05Continuous compliance — the automated auditCompliance · advanced · ~25 min
6. 06The least bureaucratic controls — the disciplineDiscipline · advanced · ~26 min

1. 01The compliance reconstruction question — what the auditor asksReconstruction · advanced · ~24 min
2. 02The reconstructability test — can you answer every question?Reconstruction · advanced · ~26 min
3. 03The deployment receipt — the artefact of recordArtefacts · advanced · ~26 min
4. 04The change authorisation record — the approval trailArtefacts · advanced · ~25 min
5. 05Segregation of duties in the pipeline — the structural controlControls · advanced · ~27 min
6. 06Six months later and the auditor — the practical testReconstruction · advanced · ~27 min

1. 01The reference architecture — the integrated view of every fleetArchitecture · advanced · ~28 minLab
2. 02The GitHub Actions control plane — the CI fleetCI · advanced · ~26 min
3. 03The Argo CD control plane — the GitOps fleetGitOps · advanced · ~27 min
4. 04The ephemeral runner fleet — the execution surfaceExecution · advanced · ~25 min
5. 05The artifact registry fleet — the artifact layerArtifact · advanced · ~26 min
6. 06The observability and audit fleet — the operational visibilityObservability · advanced · ~27 min

No lessons published in this part yet. The full curriculum is planned in docs/courses/git-cicd-gitops/curriculum.md on GitHub.

No lessons published in this part yet. The full curriculum is planned in docs/courses/git-cicd-gitops/curriculum.md on GitHub.

1. 01Git internals and recovery — recapFinal Review · advanced · ~25 min
2. 02CI/CD architecture and runner security — recapFinal Review · advanced · ~28 min
3. 03Supply chain and signing — recapFinal Review · advanced · ~28 min
4. 04GitOps reconciliation and drift — recapFinal Review · advanced · ~28 min
5. 05Incident response and secrets — recapFinal Review · advanced · ~28 min
6. 06Auditability and compliance — recapFinal Review · advanced · ~28 min