yuval.guide — Guides and hands-on courses on DevOps, cloud, Linux, Python, Kubernetes, networking and AI.

In this task main stops taking changes directly: a change reaches it only through a pull request that has an approval. The approver is pr-reviewer, a GitHub App written for this site's courses: a stand-in for a senior team member. On a real team, a person reads every pull request, and approves only a change they judge …

In this task the first placeholders become real: the image-build and image-push jobs. The image is built on a GitHub runner, a fresh machine per job, not on your own. Only the merge workflow pushes it to Docker Hub. A pull request builds the image and throws it away; a topic branch builds none. The push needs a Docker …

In this task you create the place the app runs, and let the pipeline reach it. Let GitHub Actions into AWS An OIDC identity provider and a role that only main of your repository may assume: the steps are in Pipeline Identities, Part 4. TODO: Terraform, or the console; and where its state lives. Estimate what the EKS …

In this task the pipeline becomes a complete solution: a merge to main puts the new version on AWS. Write the deploy job Assume the role with aws-actions/configure-aws-credentials. Option 1: EKS A Deployment (two replicas, readiness probe on /healthz) and a Service of type LoadBalancer, in deploy/. The job sets the …

In this task the branch workflow's placeholders become real. Lint the code ruff check and ruff format --check. FastAPI track: mypy as well. Run the unit tests pytest with coverage; fail under a threshold. TODO: the threshold. actions/setup-python with pip caching. A matrix of Python versions. TODO: which. Run the same …

In this task the pull request runs what is too slow for every push. Add a database TODO: PostgreSQL in place of the Task 1 storage, or keep SQLite and skip this. Run the integration tests Start the image built in image-build, and a database as a service container. Call every route over HTTP, end to end. TODO: pass the …

In this task you try out tools that inspect the code and the image, and keep the ones worth a required check. Scan the code CodeQL (GitHub code scanning) for Python. Bandit. TODO: or Semgrep. Scan the dependencies Dependabot alerts and version updates. The dependency review action on pull requests. pip-audit. Scan for …

A GitHub Actions workflow is a script that lives in a repository and runs when something happens to that repository. Where it lives: a YAML file in the repository's .github/workflows/ directory, committed like any other file. When it runs: on the events it names — a push, a pull request, a button press, a schedule. …

GitHub Actions runs a workflow when something happens in a repository. An event in the repository, such as a push, starts a run of every workflow that asks for it. The run's job runs on a runner: a fresh virtual machine GitHub creates for it. The runner carries out the job's steps, and the steps act on other places. …

In this part of the pipelines identities you'll create the application repository you'll be using throughout the lab. Here are the calls you'll cover: call 1, you → your repository: you push, over SSH or HTTPS; call 2, job → GitHub: the job checks out the code with GITHUB_TOKEN. It needs only a GitHub account. Create …