Career path

CI/CD Engineer

Enable a team to ship its changes to production often, safely and traceably, through an automated, reproducible and diagnosable delivery chain.

Aim for this jobWhat this job does

• 6 responsibilities
• 12 missions
• 47 skills
• 204 hours of work an estimate, starting from zero

Your gap

What you are missing

Aiming for this job computes your path from what you have already read and passed (quizzes, labs). You then see everything that remains from your first step.

321

lessons

~204 h

from zero

Aim for this job

Saved in this browser. Can be changed at any time.

The job

What a CI/CD Engineer does

Six responsibilities. Each one is carried out through concrete missions, which require skills.

1

Automate integration: build, tests and packaging on every change

Do on your own 2 missions · 9 skills

Missions that make it up

• Build a reliable pipeline

  Deliverablea pipeline that tests notes-api on every push and fails when a test breaks

  • Work with branches and merge
  • Build an OCI image
  • Write the integration stages in the repository and make them fail usefully
  • Write a first pipeline and read its failures

  4 skills Proof lab

• Validate configuration on every change

  Deliverableconfiguration files linted and schema-validated, locally and in CI

  • Validate a YAML document with linting, schemas and automated checks
  • Validate JSON strictly and against a JSON Schema
  • Write a first pipeline and read its failures
  • Test infrastructure code without a cloud account: apply, empty plan and destroy, locally and in CI

  4 skills No lab yet

Also required, outside missions

• Read and transform data (JSON, YAML, APIs)
• Write a tested command-line tool

2

Secure the delivery chain

Do on your own 2 missions · 9 skills

Missions that make it up

• Model the application's threats

  Deliverablea STRIDE model of notes-api, checked by the pipeline

  • Threat-model an application
  • Write a first pipeline and read its failures

  2 skills Proof lab

• Harden the delivery chain

  Deliverableblocking secrets and SAST checks, keyless OIDC identity, audited workflows

  • Analyze code and dependencies
  • Replace the shared secret with a verifiable machine identity (OIDC)
  • Spot the risks of a delivery chain
  • Secure a pipeline definition: permissions, secrets, pinning and triggers
  • Audit a CI workflow and model its threats

  5 skills Proof lab

Also required, outside missions

• Think DevSecOps: risks, responsibilities, defense in depth
• Triage vulnerabilities and date the exceptions

3

Deliver to environments reproducibly

Do on your own 4 missions · 13 skills

Missions that make it up

• Publish a release: versioning, standard messages, readable history

  Deliverablea release tagged in SemVer from the commit messages, its release notes generated, publication refused when a message does not comply

  • Understand and use Git history
  • Standardize a team's commit messages and have them checked automatically
  • Deliver to environments, artifacts included

  3 skills No lab yet

• Deliver the same artefact to several environments

  Deliverablean artefact built once, promoted from staging to production reproducibly, under control and traceably, with configuration specific to each environment

  • Build an artifact once and promote it across environments
  • Update an application and roll back
  • Configure an application with ConfigMaps and Secrets
  • Make a workload reliable: health probes and resources
  • Design dynamic pipelines (variables, conditions, reuse)
  • Deliver to environments, artifacts included
  • Adapt manifests per environment with Kustomize
  • Change Kubernetes resources declaratively without drifting from Git

  8 skills No lab yet

• Deploy with GitOps

  Deliverablenotes-api deployed and promoted between two environments from Git

  • Deploy and observe an application on Kubernetes
  • Deploy an application with GitOps
  • Synchronize and promote across environments

  3 skills No lab yet

• Roll out a change progressively without service interruption

  Deliverablea new version deployed in stages, its availability held and its rollback ready

  • Update an application and roll back
  • Make a workload reliable: health probes and resources
  • Change Kubernetes resources declaratively without drifting from Git
  • Synchronize and promote across environments

  4 skills No lab yet

4

Guarantee the origin and integrity of delivered artefacts

Do on your own 1 mission · 7 skills

Missions that make it up

• Deliver a traceable artefact

  Deliverablea hardened image, its SBOM and a provenance attestation

  • Read an OCI image and check its integrity: index, manifest, config, layers and digests
  • Secure the installation and the containers
  • Harden the build, the images and the IaC
  • Produce an artifact's SBOM and qualify its vulnerabilities with a VEX
  • Publish an image to a registry: access token, tag, digest and publishing from CI
  • Sign an artifact, attest its provenance and verify it before deployment

  6 skills Proof lab

Also required, outside missions

• Assess your software supply chain's exposure and respond to a compromised component

5

Run and troubleshoot the delivery chain

Do on your own 2 missions · 6 skills

Missions that make it up

• Make the chain fast and diagnosable

  Deliverablea pipeline sped up by caching and parallelism, whose failures are diagnosed without blind reruns

  • Speed up and debug a pipeline

  1 skill No lab yet

• Run a CI execution environment

  Deliverablea runner installed and equipped, running with controlled permissions, reaching the repository and the registry, whose system or network incidents can be diagnosed

  • Manage users, permissions and processes
  • Install and maintain software
  • Troubleshoot the network and read the logs
  • Operate and troubleshoot Docker containers: lifecycle, logs, inspection and daemon
  • Harden and isolate CI runners

  5 skills No lab yet

6

Improve and standardise the chain for the team

Design and improve 1 mission · 4 skills

Missions that make it up

• Standardise a team's CI

  Deliverablepipeline templates reused by several repositories, with their contribution rules

  • Document code: comments that say why, docstrings, generated reference
  • Give a repository its README, CHANGELOG and ADRs
  • Build and publish documentation checked in CI
  • Govern and tool an organization's CI

  4 skills No lab yet

The means

With which tools?

Choose your tools: the choice changes the lessons to read, never the responsibilities.

Continuous integration platform

GitHub Actions GitLab CI

GitOps tool

Argo CD Flux

Automation language

Python Go

Deployment target

• Kubernetes · covered
• Machines virtuelles · not covered yet
• Plateforme managée ou serverless · not covered yet

Going further

Specialisations

Optional, measured apart from the job.

Deliver on Kubernetes in depth

• Expose an application with a Service, Ingress or Gateway
• Run one-off and scheduled tasks (Job, CronJob)
• Give a workload a minimal identity (ServiceAccount)
• Detect and contain at runtime
• Isolate traffic between Pods with NetworkPolicies
• Compose a multi-container Pod: init, sidecar, shared volumes
• Harden a Pod's execution context (securityContext)
• Troubleshoot a failing application on Kubernetes

Provision the CI environments

• Format, validate and lint HCL files, in CI and locally
• Query and modify HCL files from a script, verifiably
• Initialise, run and troubleshoot a Terraform project, from init to destroy
• Share a remote, locked and recoverable Terraform state
• Organize several environments and a Terraform repository without dangerous coupling
• Run and govern Terraform remotely with HCP Terraform
• Describe and deploy instances in Terraform with the hypervisor's provider
• Deliver infrastructure as code under control: approved plan, policies, engine identity and cost
• Run Terraform non-interactively in a pipeline, with guardrails

Deliver database migrations

• Automate SQL operations reliably and safely
• Evolve a relational schema without putting the service at risk
• Persist data in Python with SQLAlchemy and version the schema with Alembic

Administer a self-hosted Git forge (Forgejo)

• Set up Forgejo on PostgreSQL behind a TLS proxy, reachable over HTTPS and SSH, then configure mail, LFS and sign-ups
• Govern access to Forgejo: organisations, teams and permissions, sign-in through an OIDC provider with an enforced second factor, and account support from the command line
• Monitor Forgejo through its logs and Prometheus metrics, fire an alert and diagnose a database outage
• Secure a Forgejo instance: webhooks kept off the internal network, brute force banned with fail2ban, a break-glass administrator account, scoped tokens and signed commits
• Back up Forgejo, copy the encrypted backup off the machine, restore it on a blank stack and write the recovery runbook
• Maintain Forgejo and upgrade it: scheduled tasks, doctor and quotas, an upgrade rehearsed on a copy with validation criteria and rollback from the backup

What the site does not cover yet

e-CF Testing level 4: not covered. The job integrates, runs and operates tests and diagnoses their failures; it does not design the test strategy (decision of 2026-10-06).

Delivery chain metrics (DORA): outside the core. Tracking them is a level 4 steering gesture, taught in steering the DevSecOps practice and offered as recommended; the pipeline supplies their data.

Virtual machine target: declared, not covered. Building a virtualised environment is recommended and describing virtual machines with Terraform belongs to the Terraform specialisation, but delivering an application on virtual machines is still to be built. Managed platform target: declared, with no content on the site.

Test automation (DORA Test automation, ROME M1827): the mission is being prepared, as no skill teaches it on its own yet (draft ci.tests.automate).

Publishing a release on GitLab: being prepared (draft ci.release.publish); on GitHub, taught by ci.deploy.environments.

Around this job

Compare with another job →

All the skills →

×

See in the glossary →