Lab & Completion

What You Will Produce

A ruleset on your fork’s main - the part of the platform’s rule this lab exercises: a pull request, with hooks and secrets green. In your fork’s clone, the platform’s hooks installed - and seen refusing a commit to main, a broken Terraform file and an amend of a pushed commit. Then the same broken file committed with --no-verify and pushed: nothing on your machine stops it. The CI job that runs every hook again (hooks) fails on your pull request, the ruleset refuses to merge it, and refuses a push straight to main too - the layers one flag cannot skip. Nothing is merged; the lab ends with the branch removed and main unchanged.

Before You Start

The baseline from Chapter 00 must be clean:

flux --context kind-sre-control-plane get kustomizations -A          # every row READY=True and SUSPENDED=False
kubectl --context kind-sre-control-plane get pods -A --no-headers | grep -vE 'Running|Completed'   # prints nothing
make smoke-test                     # 9/9

This chapter also needs:

  • every tool make check-tools lists - pre-commit and checkov, and the hooks’ test tools: yq, kyverno, promtool, helm, kubeconform - and network access (one hook verifies real images in the registry);
  • the GitHub CLI signed in (gh auth status) and GitHub Actions enabled in your fork’s Actions tab. Both are required: the CI layer and the ruleset are what this chapter proves.

The Lab in Three Parts

  • A. Verify - hooks installed and proven, every check passing by hand on a branch, the checks the platform requires - and the same rule on your fork’s main.
  • B. Break & Fix - the branch guard; a broken Terraform file refused by its hook; the same file through --no-verify and a push, caught by CI in your fork and refused at merge; an amend of a pushed commit refused; the fix as a new commit; a push straight to main refused.
  • C. Rollback & Cleanup - the pull request closed unmerged, the branch removed, main unchanged, the ruleset kept, the baseline proven.

Open the lab →

Done When

  • head -2 .git/hooks/pre-commit printed # File generated by pre-commit (A2)
  • pre-commit run --all-files on your branch printed only Passed and Skipped (A3)
  • your fork’s main lists pull_request and required_status_checks (A5)
  • git commit on main printed COMMIT BLOCKED: Cannot commit directly to 'main' (B1)
  • the commit of lab-broken.tf failed with Reference to undeclared input variable (B2)
  • with --no-verify the commit was made and git push went through (B3)
  • on your pull request hooks failed and secrets passed (B3)
  • gh pr merge refused: the base branch policy prohibits the merge (B3)
  • git commit --amend --no-edit --no-verify printed BLOCKED: Cannot amend commits that have been pushed! (B4)
  • after the fix, hooks and secrets passed (B5)
  • git push --no-verify origin HEAD:main was refused with GH013 (B6)
  • at the end, the pull request is closed unmerged, C1 printed main unchanged, git status --short prints nothing and the baseline is clean (C1-C2)

Knowledge Check

Before finishing this chapter, complete the Quiz.