Course 5 of 7 · The deployment/infra track
CI/CD & Delivery, from newcomer to interview-ready
The machine that turns a git push into a running deployment — build, test, and roll out across the env×org matrix.
Courses 1–4 built the artifact and its config: a container, running as Kubernetes objects, generated by Helm, routed by Istio. None of that reaches a cluster by magic. CI/CD is the machine — ~99 GitHub Actions workflows, ~80 composite actions, trunk-based deploy, self-hosted ARC runners, keyless GCP auth, and binary-authorization supply-chain checks. This is how your code ships. Three parts, built one at a time. Lessons are short — one win each. Read them in order.
skaffold run / helm upgrade
you met in Courses 1 & 3, automated.
Part 1 — CI/CD & GitHub Actions fundamentals available now
The vocabulary and the workflow model everything else builds on.
1 · What CI/CD is & why
Continuous integration / delivery / deployment — and this repo's push-based model.
ready2 · GitHub Actions anatomy
Workflows, events, jobs, steps, actions, runners — the model.
ready3 · The CI pipeline
Lint, unit tests, codegen drift checks, build — the PR checks.
ready4 · Reusable workflows & composite actions
Staying DRY across ~99 workflows — pipeline reuse vs step reuse.
readyPart 2 — Build, deploy & trunk-based delivery available now
From a merge to a running deployment across every env×org cell.
5 · Building & pushing images
Docker buildx → GCR, tagged by the release tag; the manifest-skip trick.
ready6 · Trunk-based deployment
The tbd.* chain — push → tag → cron → deploy, per env×org, with gates.
7 · Self-hosted ARC runners
Actions Runner Controller — autoscaling runners as pods, and the dind trick.
ready8 · The deploy mechanism
skaffold deploy → helm upgrade from CI; push-based vs GitOps.
Part 3 — Security, supply chain & operations available now
Keyless auth, provable builds, testing at scale, and running the pipeline.
9 · Keyless GCP auth (OIDC/WIF)
Workload Identity Federation — deploy with no static keys.
ready10 · Binary authorization & supply chain
Attestation → admission control — the machinery, and why it's audit-only here.
ready11 · Testing at scale
Unit + kind-in-runner E2E, the diff router, and the drift guards.
ready12 · Operations & the delivery model
Concurrency, caching, path filters, rollback — the whole picture.
readyPart 4 — Senior CI/CD judgment new
The senior stretch — delivery truthfulness, partial guardrails, rollback judgment, supply-chain realism, design review, and interview-grade answers.
13 · CI/CD truthfulness
Tell the real post-merge story accurately: tags, cron batching, staging auto-deploy, and manual prod.
new14 · Guardrails & false confidence
Separate useful controls from fully blocking enforcement and explain the gap honestly.
new15 · Rollback judgment
Reason about deployment confidence, reversibility, and blast radius like a senior engineer.
new16 · Supply-chain realism
Explain identity, proof, and enforcement as separate layers of the CI/CD security story.
new17 · Reviewing CI/CD designs
Review pipelines for truthfulness, recoverability, maintainability, and real safety.
new18 · Senior interview questions
High-signal CI/CD questions with answer shapes that sound like real delivery experience.
new19 · Mock senior interview pack
A retrieval-first mock round with scoring and strong answer points.
newReference shelf
Cheat sheet
Dense revision sheet + workflow syntax + interview one-liners.
Glossary
The canonical vocabulary, opinionated.
Repo CI/CD map
Ground truth: workflows, actions, deploy scripts, binauthz.
Resources
GitHub Actions + GCP docs, trunk-based dev, SLSA, plus senior CI/CD judgment topics.
Senior backend playbook
The compressed version of the new senior part: delivery truthfulness, partial guardrails, rollback judgment, supply-chain realism, review judgment, and interview answers.