Write a gated pipeline file

Objectives

Fill in the teaching pipeline from the requirements. Its schema defines the file structure. The file cannot run directly on a hosting platform.

Pull request events run checks, not deployment. Require main and approval before a trusted run after merging may deploy. Use only shown fields. Do not add credential values or executable commands.

Trigger: pull_request. Ordered stages: lint, test, policy_check, deploy. Each job uses its stage name and run command lint, test, policy-check or deploy. Dependencies: test needs lint; policy_check needs test; deploy needs policy_check. Deploy requires approval and branch main. Test saves test-report with include_commit_sha and include_run_id true. Deploy secret_ref DEPLOY_TOKEN, secret_scope deploy, expose_to_pull_requests false, log_secrets false. No other secret values or fields.

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Review updates trigger checks

   Set the trigger to pull_request. Done means review updates start checks. Do not treat this trigger as permission to deploy.

   Review updates trigger checks

2. Step 2

   Run all stages in order

   List lint, test, policy_check and deploy in that order. Done means all four stages appear. Do not skip the policy check.

   Run all stages in order

3. Step 3

   Assign each job a stage and action

   Assign each job its required stage and run command. Done means both match the contract. Do not confuse policy_check with policy-check.

   Assign each job a stage and action

4. Step 4

   Gate deployment on checks and approval

   Make deploy depend on policy_check and require approval on main. Done means all three restrictions exist. Do not rely on approval alone.

   Gate deployment on checks and approval

5. Step 5

   Retain evidence for the tested revision

   Save test-report with commit and run identifiers enabled. Done means both identifiers accompany the report. Do not save evidence without its revision.

   Retain evidence for the tested revision

6. Step 6

   Reference a scoped secret without plaintext

   Reference the secret only in deploy. Done means scope and exposure settings match the contract. Do not insert or print a token value.

   Reference a scoped secret without plaintext

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.