Lab: A complete CI/CD pipeline with correction

What you will learn in this TP

• Write a test → build workflow
• Add a security scan
• See a test fail

The pipeline #

What you will learn in this section

• Write a test → build workflow
• Add a security scan
• See a test fail

Context. A team ships by hand, with frequent mistakes and painful rollbacks. A CI/CD pipeline automates tests, build and publishing on every change: you build a complete one and see how it blocks a faulty change.

Prerequisites: A GitHub (or GitLab) account, Docker  ·  Estimated time: 45 min

From application to registry.

1. 1. A testable application

   Why? A unit test is the pipeline's safety net: without it, automating deployment only automates mistakes.

   Create a small API and a unit test.
   See the correction

   # app.py
   def addition(a, b): return a + b
   # test_app.py
   from app import addition
   def test_addition(): assert addition(2, 3) == 5

   pip install pytest && pytest -q

2. 2. Dockerfile and workflow

   Why? The "build needs test" dependency guarantees an image is never published if tests fail.

   Write the workflow: tests then image build.
   See the correction

   # .github/workflows/ci.yml
   name: ci
   on: { push: { branches: [main] }, pull_request: {} }
   jobs:
     test:
       runs-on: ubuntu-latest
       steps:
         - uses: actions/checkout@v4
         - uses: actions/setup-python@v5
           with: { python-version: "3.12" }
         - run: pip install pytest && pytest -q
     build:
       needs: test
       runs-on: ubuntu-latest
       permissions: { contents: read, packages: write }
       steps:
         - uses: actions/checkout@v4
         - uses: docker/login-action@v3
           with: { registry: ghcr.io, username: ${{ github.actor }}, password: ${{ secrets.GITHUB_TOKEN }} }
         - uses: docker/build-push-action@v6
           with: { push: true, tags: "ghcr.io/${{ github.repository }}:${{ github.sha }}" }

3. 3. Add a security scan

   Why? Integrating security in the pipeline (shift-left) finds a vulnerability at build time rather than in production.

   Fail the pipeline on critical vulnerabilities.
   See the correction

         - uses: aquasecurity/trivy-action@0.24.0
           with: { image-ref: "ghcr.io/${{ github.repository }}:${{ github.sha }}", severity: CRITICAL, exit-code: "1" }

4. 4. Observe and fix

   Why? Deliberately breaking a test proves the pipeline does its job: it blocks the change and protects the main branch.

   Deliberately break the test, see it fail then fix it.
   See the correction

   sed -i 's/== 5/== 6/' test_app.py && git commit -am 'test cassé' && git push
   # le job test échoue, build ne s'exécute pas (needs)
   git revert HEAD && git push

Difficulty level : ●●○○○ (2/5)