Certificate

# ===== Award criteria =====
# Pass: >= 70%; Distinction >= 85%.
#
# 1. Pipeline design            (15)
# 2. Testing stages             (15)
# 3. Security scanning          (15)
# 4. Build + artifacts          (10)
# 5. Deployment strategy        (15)
# 6. Observability + alerts     (10)
# 7. Rollback rehearsed         (10)
# 8. Communication              (10)

# ===== Project brief =====
# Take an existing repo (yours or open-source) and build a complete CI/CD pipeline:
# - Lint + typecheck + test stages
# - Security: SAST (Semgrep / CodeQL), SCA (Snyk / OSV), container scan (Trivy)
# - Build Docker image; push to registry; sign with cosign
# - Deploy to staging on every main; to production with manual approval
# - Feature flag (LaunchDarkly / Unleash / Flagsmith) demoed
# - Observability: build metrics, deploy events, SLO alerts
# - Rollback runbook + tested

# ===== Pipeline target tools (pick one) =====
# - GitHub Actions
# - GitLab CI
# - Buildkite
# - CircleCI
# - Jenkins
# - Azure Pipelines

# ===== Sample structure =====
# my-repo/
#   .github/workflows/
#     ci.yml
#     deploy.yml
#     scan.yml
#   .zap/ rules.tsv
#   .semgrep/
#   Dockerfile
#   compose.yml
#   k8s/
#   docs/
#     PIPELINE.md
#     ROLLBACK.md
#     RUNBOOK.md

# ===== Marking sheet (example) =====
# 1. Pipeline         14/15   stages well-ordered, parallel where safe
# 2. Testing          13/15   unit + integration + e2e with junit report
# 3. Security         14/15   SAST + SCA + container scan + secrets scan
# 4. Build             9/10   multi-arch image; signed
# 5. Deployment       14/15   canary or staged rollout with health checks
# 6. Observability     9/10   metrics + dashboards + SLO alerts
# 7. Rollback          9/10   rehearsed; runbook with screenshots
# 8. Communication     9/10   README + ADRs
# Total: 91/100 -> Distinction

# ===== Patterns to internalise =====
# - Cheap stages first (lint, typecheck, test)
# - Required status checks on default branch
# - Build once, promote through environments
# - Feature flags decouple deploy + release
# - Signed images + SBOM + scans in pipeline
# - Manual approvals on prod; automated rollback on SLO breach
# - GitOps for cluster state

# ===== Pitfalls =====
# - Slow pipelines (> 30 min)
# - 'latest' tags in prod
# - Secrets in plain YAML
# - No rollback rehearsed
# - Coverage gates that punish but don't help

# /certificate/cicd