Secure CI/CD with GitLab
Centered on GitLab CI (with GitHub Actions and Jenkins shown where they differ). Start with the .gitlab-ci.yml mental model, then treat the pipeline as production: threat-model it, isolate runners, lock down secrets, add SAST/secret/dependency/image/DAST scanning that developers keep enabled, sign and attest artifacts, and deliver with GitOps behind approvals, canary, and rollback. Seventeen lessons across five sections, each ending with a self-test.
01Threat-model your pipelinePoisoned deps, leaked runners, tampered artifacts.12 min02Protected branches, tags & environmentsWho can change and deploy what.12 min03Runner isolation & protected runnersKeep feature branches off production runners.14 min04CI/CD variables, masking & secret managersSecrets that do not leak into logs or forks.14 min
01SAST & code scanningFind bugs in your own source.12 min02Secret detectionCatch the committed key before main.10 min03Dependency scanning (SCA)The CVEs you inherited from your libraries.12 min04Container image scanningTrivy: report all, fail on critical.12 min05DAST & the scan pipelineTest the running app; wire it all together.12 min
Progress is saved in this browser only — no account required.
Final exam
Test yourself on everything
50 questions drawn from all 5 sections — every answer explained as you pick.