Git, CI/CD & GitOps · Operational reference
Toolkit
Operational artefacts for Git, CI/CD & GitOps: checklists for cadences, runbooks for incidents, hands-on labs for skills, and break/fix scenarios for troubleshooting reflexes. None of this replaces reading the corresponding lessons — these are the artefacts you keep open in a second tab during real work.
- Runbooks
- 30
- Checklists
- 15
- Labs
- 31
- Break/Fix
- 30
- Assessments
- 2
Operational checklists
Repetitive tasks performed on a schedule.
Before deployment
- Git Repository Production Readiness Checklist17 items→
- Pull Request Review Checklist16 items→
- Infrastructure Change Review Checklist15 items→
- CI Pipeline Security Checklist15 items→
- CI Runner Security Checklist16 items→
- CI/CD Supply Chain Security Checklist14 items→
- Artifact Release Checklist15 items→
- Pre-Deployment Checklist15 items→
- Post-Deployment Validation Checklist16 items→
- GitOps Production Readiness Checklist15 items→
- GitOps Repository Review Checklist15 items→
- Secrets Review Checklist15 items→
Runbooks
Step-by-step procedures. Treat the rollback as part of the procedure — never skip it.
Critical risk
- criticaldata loss riskRunbook: Recover from a Bad `git reset`~30 min · 11 steps · verified 2026-08-20→
- criticalservice affectingRunbook: Revert a Production Change~45 min · 13 steps · verified 2026-08-20→
- criticalsecurity relevantRunbook: Respond to a Force-Push Incident~60 min · 12 steps · verified 2026-08-20→
- criticalsecurity relevantRunbook: Respond to a Secret Committed to Git~60 min · 16 steps · verified 2026-08-20→
- criticalsecurity relevantRunbook: Respond to a CI Secret Leak~60 min · 10 steps · verified 2026-08-20→
- criticalsecurity relevantRunbook: Respond to a Compromised Runner~90 min · 12 steps · verified 2026-08-20→
- criticalsecurity relevantRunbook: Respond to a Compromised Dependency~90 min · 10 steps · verified 2026-08-20→
- criticalcluster affectingRunbook: Recover a GitOps Controller~60 min · 13 steps · verified 2026-08-20→
- criticalcluster affectingRunbook: Recover Git Hosting Dependency (Multi-Remote Failover)~60 min · 12 steps · verified 2026-08-20→
- criticalservice affectingRunbook: Recover from an Artifact Registry Outage~60 min · 13 steps · verified 2026-08-20→
- criticalsecurity relevantRunbook: Rotate a Deployment Identity (OIDC Reconfiguration)~60 min · 12 steps · verified 2026-08-20→
- criticalservice affectingRunbook: Recover an Infrastructure Pipeline~90 min · 14 steps · verified 2026-08-20→
- criticalsecurity relevantRunbook: Respond to a Supply-Chain Compromise~120 min · 13 steps · verified 2026-08-20→
- criticalcluster affectingRunbook: Restore CI/CD After a Disaster~180 min · 13 steps · verified 2026-08-20→
High risk
- highdata loss riskRunbook: Recover a Deleted Branch via Reflog~30 min · 9 steps · verified 2026-08-20→
- highdata loss riskRunbook: Recover from a Bad `git rebase`~45 min · 11 steps · verified 2026-08-20→
- highservice affectingRunbook: Resolve an Infrastructure Merge Conflict~45 min · 14 steps · verified 2026-08-20→
- highsecurity relevantRunbook: Rotate Git Credentials~45 min · 13 steps · verified 2026-08-20→
- highservice affectingRunbook: Troubleshoot a Failed CI Pipeline~30 min · 10 steps · verified 2026-08-25→
- highservice affectingRunbook: Troubleshoot a Runner~30 min · 10 steps · verified 2026-08-20→
- highservice affectingRunbook: Restore Runner Capacity~30 min · 10 steps · verified 2026-08-20→
- highservice affectingRunbook: Validate a Production Artifact~30 min · 10 steps · verified 2026-08-20→
- highservice affectingRunbook: Roll Back a Deployment (Container, Kubernetes, Terraform)~60 min · 10 steps · verified 2026-08-20→
- highservice affectingRunbook: Troubleshoot GitOps Repository Authentication~45 min · 10 steps · verified 2026-08-20→
- highservice affectingRunbook: Troubleshoot GitOps Reconciliation (OutOfSync, Degraded)~45 min · 12 steps · verified 2026-08-20→
- highservice affectingRunbook: Reconcile an Emergency Manual Production Change~45 min · 10 steps · verified 2026-08-20→
- highservice affectingRunbook: Investigate a Wrong-Environment Deployment~60 min · 12 steps · verified 2026-08-20→
- highservice affectingRunbook: Investigate a Production Deployment Failure (CI Green but Prod Broken)~60 min · 12 steps · verified 2026-08-20→
- highcluster affectingRunbook: Validate GitOps After Cluster Recovery~60 min · 14 steps · verified 2026-08-20→
Hands-on labs
Time-boxed exercises.
C · Simulation
- Lab 1: Inspect git objects with plumbing commands~60 min · 5 objectives→
- Lab 2: Visualise the commit DAG~45 min · 5 objectives→
- Lab 3: Resolve a realistic Terraform merge conflict with a state file~75 min · 6 objectives→
- Lab 4: Rebase a feature branch safely and identify the failure if force-pushed~60 min · 6 objectives→
- Lab 5: Recover a "deleted" branch using the reflog~50 min · 6 objectives→
- Lab 6: Use `git bisect run` to identify the breaking infrastructure commit~75 min · 6 objectives→
- Lab 7: Configure SSH signing for commits and tags~60 min · 6 objectives→
- Lab 8: Build a GitHub Actions workflow with branch protection and required status checks~75 min · 6 objectives→
- Lab 9: Build a multi-job CI pipeline with `needs`, matrix, and conditional execution~60 min · 6 objectives→
- Lab 10: Add `tflint`, `tfsec`, and `kubeconform` to a multi-IaC pipeline~90 min · 6 objectives→
- Lab 11: Add secret scanning (`gitleaks`) and dependency review to a pipeline~75 min · 6 objectives→
- Lab 12: Build, sign, and verify an OCI image with Cosign keyless~90 min · 6 objectives→
- Lab 13: Configure a self-hosted runner through the supported interface~75 min · 5 objectives→
- Lab 14: Authenticate CI with short-lived identity via OIDC federation~90 min · 6 objectives→
- Lab 15: Build a Terraform CI pipeline with plan-as-artifact and PR comment~90 min · 6 objectives→
- Lab 16: Build an Ansible CI pipeline with `ansible-lint`, syntax check, Molecule~90 min · 6 objectives→
- Lab 17: Build a container supply-chain pipeline (build → SBOM → scan → sign)~90 min · 6 objectives→
- Lab 18: Validate Kubernetes manifests with `kubeconform`, `conftest`, `kyverno`~75 min · 6 objectives→
- Lab 19: Design and validate an Argo CD installation~100 min · 5 objectives→
- Lab 20: Reconcile a Kubernetes application through Argo CD with `syncPolicy.automated`~90 min · 6 objectives→
- Lab 21: Detect drift between Git and cluster with Argo CD~90 min · 6 objectives→
- Lab 22: Handle an emergency manual change — disable self-heal, fix, document, restore~90 min · 6 objectives→
- Lab 23: Perform a GitOps rollback via `argocd app rollback` and validate~90 min · 6 objectives→
- Lab 24: Rotate deployment credentials — AWS access key to OIDC federation~120 min · 6 objectives→
- Lab 25: Recover from a compromised dependency — revoke, rebuild, re-pin~120 min · 6 objectives→
- Lab 26: Recover CI after a credential rotation~90 min · 6 objectives→
- Lab 27: Recover from an artifact registry outage — multi-region, immutable cache~120 min · 7 objectives→
- Lab 28: Recover GitOps after a controller failure~120 min · 6 objectives→
- Lab 29: Audit a historical production deployment end-to-end~120 min · 8 objectives→
- Lab 30: End-to-end production delivery capstone with 10 injected incidents~180 min · 5 objectives→
- Lab 31: Design Windows self-hosted runner operations with PowerShell~75 min · 5 objectives→
Break/Fix scenarios
Troubleshooting drills. Each scenario gives symptoms and evidence, then hides the solution behind a reveal.
ci-runner
supply-chain-compromise
gitops-repo
gitops-reconciliation
supply-chain-signing
cicd-approval
cicd-pipeline
Assessments
Production-readiness examinations. Each combines auto-scored questions with scenario-based rubrics you can use to grade yourself.
- Git, CI/CD & GitOps for Infrastructure Engineers — Final Practical Assessment~180 min · 10 graded questions · 50 in practice bank · pass ≥ 80% · verified 2026-08-25→
- Git, CI/CD & GitOps for Infrastructure Engineers — Final Theory Assessment~150 min · 73 graded questions · pass ≥ 80% · verified 2026-08-25→