In this task the pipeline becomes a complete solution: a merge to main puts the new version on AWS. Write the deploy job Assume the role with aws-actions/configure-aws-credentials. Option 1: EKS A Deployment (two replicas, readiness probe on /healthz) and a Service of type LoadBalancer, in deploy/. The job sets the …

In this task the branch workflow's placeholders become real. Lint the code ruff check and ruff format --check. FastAPI track: mypy as well. Run the unit tests pytest with coverage; fail under a threshold. TODO: the threshold. actions/setup-python with pip caching. A matrix of Python versions. TODO: which. Run the same …

In this task the pull request runs what is too slow for every push. Add a database TODO: PostgreSQL in place of the Task 1 storage, or keep SQLite and skip this. Run the integration tests Start the image built in image-build, and a database as a service container. Call every route over HTTP, end to end. TODO: pass the …

In this task you try out tools that inspect the code and the image, and keep the ones worth a required check. Scan the code CodeQL (GitHub code scanning) for Python. Bandit. TODO: or Semgrep. Scan the dependencies Dependabot alerts and version updates. The dependency review action on pull requests. pip-audit. Scan for …

GitHub Actions Section Posts Basics GitHub Actions Workflows: an Introduction GitHub Actions Workflows: the Structure of the File Interactive views GitHub Actions: a Workflow Run Pipeline Identities Overview: The Services and Their Credentials Part 1: Your Repository and GITHUB_TOKEN Part 2: Docker Hub and a Stored …

A GitHub Actions workflow is a script that lives in a repository and runs when something happens to that repository. Where it lives: a YAML file in the repository's .github/workflows/ directory, committed like any other file. When it runs: on the events it names — a push, a pull request, a button press, a schedule. …

GitHub Actions runs a workflow when something happens in a repository. An event in the repository, such as a push, starts a run of every workflow that asks for it. The run's job runs on a runner: a fresh virtual machine GitHub creates for it. The runner carries out the job's steps, and the steps act on other places. …

In this part of the pipelines identities you'll create the application repository you'll be using throughout the lab. Here are the calls you'll cover: call 1, you → your repository: you push, over SSH or HTTPS; call 2, job → GitHub: the job checks out the code with GITHUB_TOKEN. It needs only a GitHub account. Create …

In this part you'll make the pipeline push a Docker image to Docker Hub. The call you'll cover: call 3, job → Docker Hub: the job pushes the image with an access token you stored in GitHub. It needs a Docker Hub account. It is the one call in the lab with a credential stored in GitHub, so it is the one a thief could …

In this part you'll have a job ask GitHub for an ID token, and print what it says. The call you'll cover: call 4, job → GitHub: the job asks for an ID token. The token says which repository and branch the job runs for, signed by GitHub. It allows nothing by itself: Part 4 shows it to AWS, which decides what to grant. …