SecureJuniorDevOpsAuto-graded

DevOps Engineer: Make the release pipeline a real gate

Make a release pipeline stop broken builds and keep its deploy token from leaking.A start-up shipped failing tests and leaked its deploy token through its own CI. With your coding agent, run the pipeline on a local CI runner, find every way a broken or wrong build, or the token, can still get out, close each one, prove it with pipeline tests, and decide how a flaky test is treated.

35 min

python, bash, yaml

Start lab

You're done when

Only a push to the main branch whose tests pass (apart from what your flaky: block allows) reaches production, and only after Arianna approves it. Branches and tags never deploy. Outside pull requests (from a fork) never deploy either, and a fork's code never runs with the repository's secrets (the deploy token among them) or write access. All of this comes from .ci/ alone: app/, tests/, run-tests and tools/runner/ are unchanged, and no real deploy token is in any file you commit or leave in the repository (the runner's own records in .ci-state/ aside).
When Arianna approves a run, production gets, byte for byte, the build made by that same run after its tests passed and before its deploy job started: never a rebuild.
The deploy token cannot be read, in any form, from the logs, artifacts or uploads of your pipeline's runs, and the deploy token that production accepts when you finish has never been readable in any run's log, artifact or upload.
The flaky ETA test (test_suggestions_on_arrival) is handled as the flaky: block in DECISIONS.md says, and every other test that fails, even once, stops the release.
Your pipeline tests pass on correct pipelines, and at least one of them fails on each pipeline that deploys what it should not, gives a fork's code the deploy token, ships a build other than the one tested, or lets the token be read.

What it measures

Mapping the failure pathsFinding every way a bad build can reach production or a secret can leak, before fixing any of them.

Proving a gatePipeline tests that fail when a hole opens again, run against correct and broken pipelines.

Not trusting 'masked' or 'rotated'Checking what a run's log and artifacts really hold, and whether the credential in use has already leaked.

Owning the decisionDeciding the flaky-test policy two colleagues disagree on, and recording why.

Your environment

Terminal + editorA full shell in the browser

Claude CodePre-authenticated, no key setup

Isolated microVMYours alone, wiped afterwards

Start this lab

35 min

Start labYou'll sign in to Anthropos to start. The lab opens in a private cloud workspace with Claude Code ready to use.

AI Labs is part of Anthropos Workforce. Not on your plan yet? Book a demo