Challengegithub-actions
GitHub Actions: Build, Scan and Deploy to EKS — Challenge
The same pipeline as the Jenkins lab, with no server to maintain and no stored AWS credentials.
- Time
- 27 min
- Level
- Intermediate
- Objectives
- 4 objectives
- Cost
- Billable
Before you start
You will need
- A GitHub repository
- An AWS account
- An EKS cluster (or adapt to any Kubernetes)
You will be able to
- Authenticate to AWS from CI with OIDC instead of an access key
- Push to ECR and deploy to EKS from a workflow
- Compare a hosted CI service with a self-managed controller honestly
Cost — Billable
Depends on an existing cluster. Actions minutes are free on public repositories. ECR storage is inside the free tier at this scale; the EKS cluster you deploy to is $0.10/hour if you created one.
You are done when
0 of 4
The goal#
Achieve the same outcome as GitHub Actions: Build, Scan and Deploy to EKS, from an empty starting point, without the steps.
The Jenkins pipeline works, and it needs a server, plugins, backups and upgrades. For a project that already lives on GitHub, there is a path with none of that.
This is not a replacement for the Jenkins lab. Knowing both, and why you would pick each, is the actual skill.
What must be true when you are done#
- A push builds an image tagged with the commit SHA and pushes it to ECR.
- No AWS access key exists in the repository — authentication is OIDC.
- A vulnerability at HIGH or CRITICAL fails the workflow before the push.
- The deployment rolls out, and the workflow fails if the rollout does not complete.
Rules#
- Do not open the guided lab until you are finished, or until the same problem has held you up for 20 minutes.
- Documentation is allowed and encouraged.
- Verify every criterion with a command whose output you can read.
If you get stuck#
- What did you expect, exactly?
- What happened instead — the error text, not a paraphrase?
- Which layer is that error from?
- What is the smallest command that proves the layer below is fine?
The concept behind it
Phase complete · 08 Continuous delivery
You can now: A commit becomes a scanned, tagged image and a deployment, with no manual step.
Next phase
Lab 47 of 58 on the project path