Skip to content

Lab 12: CI/CD Pipeline

Field Value
Tier 3 — Operations
Estimated Time 60 minutes
Prerequisites Docker, Git
Auto-Grade Yes

Scenario

Your team is deploying a Python web application manually. Every release involves someone SSH-ing into the server, pulling the latest code, running tests by hand, and restarting the service. Last month, a developer pushed broken code directly to main and the manual deployer did not notice the tests were failing. The bug reached production and took down the payment processing page for two hours.

The engineering director has mandated that all deployments go through an automated CI/CD pipeline. You need to build a pipeline that lints the code, runs tests, builds a Docker image, scans it for vulnerabilities, and deploys to a staging environment. The pipeline must block deployments if tests or security scans fail.

Objectives

  • Create a GitHub Actions workflow file at .github/workflows/ci.yml
  • Pipeline has a lint job that runs flake8
  • Pipeline has a test job that runs pytest and requires lint to pass
  • Pipeline has a build job that builds a Docker image
  • Pipeline has a scan job that runs Trivy on the built image
  • Pipeline has a deploy job that only runs on main branch after all checks pass
  • All jobs use proper dependency chains (needs:)

Setup

./setup.sh

Creates a sample Python project at /tmp/lab-cicd/ with tests and a Dockerfile.

Hints

Hint 1: Workflow structure 
name: CI/CD
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
jobs:
  lint:
    runs-on: ubuntu-latest
    steps: ...
Hint 2: Job dependencies Use `needs:` to create dependency chains: 
test:
  needs: lint
build:
  needs: test
Hint 3: Conditional deployment Use `if: github.ref == 'refs/heads/main'` on the deploy job to only deploy from the main branch.
Hint 4: Trivy scanning 
- name: Run Trivy
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: 'myapp:${{ github.sha }}'
    exit-code: '1'
Hint 5: Artifact passing Use `actions/upload-artifact` and `actions/download-artifact` to pass the Docker image between the build and scan jobs, or use a container registry.

Grading

./grade.sh

Solution

See the solution/ directory for the complete workflow file.