Ship changes with Git, CI/CD and GitOps

• Used for: everything as code; GitOps; rollback with git revert.

$git switch -c feat/health-check
$git add -p && git commit -m "Add /health endpoint"
$git push -u origin feat/health-check
$git log --oneline --graph -10

Security checklist:

• Protect main: required reviews and checks, no force push.
• Sign commits (SSH or GPG) so GitHub shows Verified.
• A committed secret is leaked: rotate it, then clean history.

$gh pr create --fill
$gh run watch
$gh run view --log-failed
$gh secret set AZURE_CLIENT_ID --body "00000000-0000-0000-0000-000000000000"
$gh api repos/OWNER/REPO/dependabot/alerts --jq '.[].security_advisory.severity'

Security checklist:

• Smallest permissions: for GITHUB_TOKEN in workflows.
• OIDC to clouds instead of long-lived secrets.

#gitlab-runner register --url https://gitlab.com --token glrt-xxxx --executor docker --docker-image alpine:3.20 --non-interactive
#gitlab-runner verify
#journalctl -u gitlab-runner -f

Security checklist:

• No privileged = true (docker-in-docker) — build with kaniko or buildah.
• Masked, protected CI variables; runners for untrusted projects separate.

#systemctl status jenkins
$java -jar jenkins-cli.jar -s http://localhost:8080 -auth admin:API_TOKEN build shop/main -s

Security checklist:

• 0 executors on the controller; builds only on agents.
• Update plugins often; SSO; never open it to the internet.
• withCredentials + single quotes in sh so secrets do not leak into logs.

$argocd app list
$argocd app diff shop
$argocd app sync shop
$argocd app history shop

Security checklist:

• SSO, delete the initial admin secret, projects to limit teams.
• Read-only deploy keys for Git; no public argocd-server.

$flux bootstrap github --owner s0sta --repository fleet --path clusters/home --personal
$flux get kustomizations
$flux reconcile kustomization shop --with-source

Security checklist:

• Encrypt secrets with SOPS (age or Key Vault) before commit.
• Check --prune paths carefully.