CI/CD Cheat Sheet

Introduction

CI/CD cheat sheet — a staff engineer's compact reference for pipeline design decisions, not syntax dumps. Unique decision tables: when to use which deploy strategy, gate policies, secret patterns, DORA targets, and interview one-liners. Use as pre-loop review, not a substitute for capstone practice.

The story

Thirty minutes before a staff loop, you don't re-read 46 lessons — you scan this sheet: trigger rules, fan-in checklist, OIDC trust shape, canary abort PromQL skeleton, rollback command, DORA vocabulary. The candidate who internalized the decision tables spent the interview drawing constraints; the one who memorized YAML keywords froze when the scenario wasn't GitHub Actions.

Understanding the topic

The sheet organizes decisions, not tools. Each row answers: when, why, trade-off, failure mode.

• Triggers: PR = verify; main = build+scan; tag = release; schedule = drift/nightly matrix.
• Artifacts: promote digest not tag; same binary all envs; SBOM attached.
• Gates: fail CRITICAL on main; warn on PR; contract test on merge path.
• Secrets: OIDC deploy jobs; vault runtime; never fork PR → prod creds.
• Rollback: digest N-1 or rollout abort; rehearse monthly; git revert for config only.

Internal architecture

One-page pipeline skeleton (memorize shape):

PR ──→ fan-out verify (no prod secrets)
main ──→ build ──→ scan ──→ fan-in
              ↓ digest
         staging (OIDC) ──→ smoke
              ↓ gate
         prod (canary/blue-green)
              ↓ observe
         rollback path always drawn LEFT of prod

Visual explanation

Two diagrams show where CI/CD Cheat Sheet lives in the delivery path and how teams implement it in production.

Step-by-step explanation

1. Pre-interview: recite skeleton from memory in 60 seconds.
2. Scan deploy strategy table — match scenario blast radius.
3. Scan gate policy table — PR vs main column.
4. Review OIDC trust shape — repo + ref + environment.
5. Review 5 interview one-liners — rollback, digest, CFR, phased v1.

Production implementation

Deploy strategy picker:

• Pick deploy row before drawing prod box — interviewers notice.
• Gate table PR vs main is the most common staff question.
• Secret column "Never" is red-team checklist.

| Strategy      | Blast radius | Rollback speed | When                          |
|---------------|--------------|----------------|-------------------------------|
| Recreate      | High downtime| Redeploy prev  | Dev/test only                 |
| Rolling       | Gradual      | Slow (undo)    | Internal tools, tolerant users|
| Blue-green    | Low          | Fast (switch)  | Stateless APIs, LB flip       |
| Canary        | Lowest       | Abort/fast     | Customer-facing, metrics exist|
| GitOps revert | Config drift | Git revert+sync| Infra/manifest promotion      |

| Gate            | PR policy | main policy | Evidence        |
|-----------------|-----------|-------------|-----------------|
| Unit test       | fail      | fail        | junit.xml       |
| SAST            | warn→fail | fail        | sarif upload    |
| Trivy CRITICAL  | warn      | fail        | SBOM CycloneDX  |
| Contract (Pact) | fail      | fail        | broker verify   |
| Prod approval   | n/a       | required    | env protection  |

| Secret pattern     | Use case              | Never                    |
|--------------------|-----------------------|--------------------------|
| OIDC + IAM role    | cloud deploy jobs     | AKIA in repo secrets     |
| GitHub Environment | prod approval audit   | shared prod+staging role |
| Vault agent        | DB/app runtime creds  | CI echo to kube secret   |
| Registry token     | push digest           | token on fork PR job     |

Execution workflow

Real-world use

Staff engineers keep personal decision tables — evolved from Accelerate DORA, Google SRE books, and scar tissue. This sheet compresses 46 lessons into interview-ready tables without replacing narrative practice.

Enterprise use cases

DORA targets by org maturity (reference, not gospel):

• Elite: deploy on-demand, lead time <1 hr, CFR <5%, MTTR <1 hr.
• High: daily deploy, lead time <1 day, CFR 5–15%, MTTR <1 day.
• Interview line: "Scan gate targets CFR; canary targets MTTR; merge queue targets lead time."
• Map your LedgerWave/capstone design to which metric each stage moves.

Production case study

Interview one-liners (say verbatim):

• Rollback: "Promote digest N-1 from registry — don't rebuild on hotfix path."
• Artifact: "One build, many envs — tag is human, digest is truth."
• Canary: "5xx rate on canary revision labels, not cluster average."
• SOC2: "SHA → digest → SBOM → approver — auditor clicks one chain."
• Phased v1: "PR CI week one; canary after SLIs trusted 30 days."

Trade-offs

• Cheat sheet pro: fast pre-loop activation of structured thinking.
• Cheat sheet con: tables without stories feel hollow in 50-min loops.
• Canary vs blue-green: canary needs metrics; blue-green needs 2× capacity.
• Hosted vs self-hosted runners: isolation vs ops burden.
• Auto-deploy vs approval: CFR vs compliance — phased hybrid usual.

Security implications

Red-team checklist (memorize 5): fork PR no prod OIDC; pin callee @semver; Cosign at admission; SBOM retained; log masking on secret-adjacent steps.

• pull_request_target + contents:write = critical risk — avoid.
• OIDC trust: restrict sub to repo + ref + environment.
• Emergency bypass requires ticket + postmortem — not standing policy.

Scalability analysis

Scale triggers: >30 eng → merge queue; >20 repos → reusable workflows; >100 PRs/day → path filters + dynamic matrix; >10 deploys/day → concurrency groups on prod.

• Runner FinOps: cost per merged PR dashboard.
• Registry: lifecycle retain last N digests for rollback.
• Prometheus: recording rules before canary analysis at scale.

Staff engineer insights

• Sheet fits on one printed page — if it doesn't, cut syntax, keep decisions.
• Tables are prompts — capstone mock turns rows into boxes and arrows.
• Update sheet after real incidents — add row to "Never" column from scar tissue.
• Cheat sheet last 30 min before loop; capstone practice last 7 days.

Best practices

• Customize sheet with your company's actual roles and registry URLs.
• Add one real incident row to gate table after each postmortem.
• Pair sheet review with 40-min LedgerWave mock — tables activate under pressure.
• Share sheet with team — vocabulary alignment reduces pipeline drift.

Anti-patterns to avoid

• Printing GitHub Actions keyword list — interviewers don't care.
• Sheet with no "Never" column — misses security posture.
• Generic DORA numbers without mapping to your gates.

Common mistakes

• Treating sheet as complete preparation — mocks still required.
• Syntax-heavy sheet — wrong document for staff level.
• Outdated deploy strategy row after org adopts GitOps — update quarterly.

Advanced interview questions

Hands-on exercise

Blank paper: reproduce deploy strategy + gate policy tables from memory. Then expand canary row into full Argo Rollouts analysis snippet. Time limit: 15 minutes.

• Add one custom row for your current employer's stack.
• Cut any syntax block that doesn't inform a decision — keep sheet ≤1 page.

Summary

You have a concise staff-level CI/CD reference — deploy picker, gate policies, OIDC patterns, DORA mapping, and interview one-liners — unique content for rapid pre-loop review.