The end-of-level exam hands you a delivery chain that lies: its pipeline is green, a version is published, and yet almost everything in it is wrong. You have one hour, with no hints, to make it honest, publish a fixed version and promote it to production. It closes the level "Understand and build a delivery chain" of the introductory course on pipelines: it asks for nothing that the core has not taught, but it asks for everything at once. The grade covers the final state of the forge and of the two environments, never the commands typed.
What you will learn
- Spot what makes a green pipeline misleading
- Make the chain honest without touching the tests
- Publish a fixed version and promote it by its fingerprint
- Name the security flaws found and their fix
What does the exam draw on?
The exam assembles the gestures of the core of the course, without adding any. The steps in the repository and the triggers come from Steps and triggers; publication and the fingerprint from Artifacts; promotion, per-environment configuration and injection from Environments and promotion; the revocation of an exposed token from Secrets in CI/CD pipelines; pinning and attack surfaces from Securing a CI/CD pipeline.
Only one piece of knowledge goes beyond the course: reading and fixing a
Python function of a few lines, because the flaw that the pipeline hid is
in the code.
If one of these gestures is missing, reread the matching lesson before starting
the lab: the exam gives no hint. It only recalls where tokens and
secrets are managed in Forgejo, as the Artifacts lesson does, and asks
you not to revoke the lab-… token, which serves your clone and the grader.
What is expected?
The inventaire repository arrives in the state left by a hurried team. The
list below says what will be checked; it does not say where the flaws are,
it is up to you to spot them by rereading the chain.
- The integration pipeline runs
make lint,make testandmake build, in this order, without masking any failure, with each action pinned by the SHA of its commit, without printing any secret, and publishes only on av*tag. mainis green, with the original tests and the originalmake testrecipe: you fix the code, not the test.- The token that leaked is revoked and replaced in the
REGISTRE_JETONsecret. - A new version is published from a green tag,
1.0.0being immutable. - The deployment installs the published version without rebuilding it, its inputs going through the environment; the new version runs in staging then in production, with the same fingerprint, enforced for production.
- The
risques.mdfile, at the root of the repository, names the security flaws found and their fix.
How is the grade computed?
Each expectation is a test that reads the state of the forge (files of
main, pipeline statuses, registry, tokens) and of the machine (deployment
log, installed artifacts, answer of each environment). A workaround does not
pass: modifying the test so that it accepts the faulty code, removing the make test step or making it tolerant to failure makes the matching check fail.
The risques.md file is checked for the presence of each flaw, not for the
quality of your justification. This part is a proof that you validate
yourself, not an attested proof: reread it with someone if you can.
Hands-on practice
The exam is played in the same virtual machine as the labs of the course,
with the Forgejo forge and its runner. It is started with
dsoxlab run level-exams-chaine after dsoxlab provision, then graded
with dsoxlab check level-exams-chaine. The installation of DSOXLab is
described in the DSOXLab documentation. Allow one hour, and
start it when the three labs of the core pass without help.
Key takeaways
- The exam assembles the gestures of the core, without adding any, plus a Python fix of a few lines.
- A green pipeline proves nothing if it masks a failure: you fix the code, never the test.
- Version
1.0.0is immutable: a fix is published under a new number, then promoted by its fingerprint. - A token read in a log is revoked and replaced; removing it from the log is not enough.
- The grade reads the final state;
risques.mdremains a proof that you validate yourself.