Skip to content
Modern Git AcademyMaster Git. Engineer on GitHub. Automate Everything.

30-Day Modern Git & DevOps Challenge

30 days · 13 labs · 14 knowledge checks · for engineers going from solid git to the full modern workflow: actions, security, automation and gitops.

Tick each day as you finish it. Progress is stored in this browser and shown onMy Academy.

  1. Explain what rebase creates and why the old commits survive in the reflog.

    Then Rebase a personal branch onto main and inspect the reflog afterwards.

  2. Reshape a branch — squash, reorder, edit — and know the direction fixup folds.

    Then Do the lab: five messy commits into two, with the diff proving nothing changed.

  3. Know the one rule with the widest blast radius and the force-push flags that actually protect.

    Then Do the lab, then alias `push --force-with-lease --force-if-includes` and never type --force for a shared branch again.

  4. Predict the history each merge method produces.

    Then Do the lab: reset a merge nobody saw, revert one they did, hit the re-merge trap.

  5. Decide a model from the five questions, not from preference.

    Then Write down your team's answers to the five questions in one paragraph.

  6. Handle an interruption without stashing.

    Then Do the lab. Keep a worktree of main beside your feature directory this week.

  7. Name the layers — event, workflow, job, runner, step — and why the runner starts empty.

    Then Read one workflow file in a repository you use and label each layer.

  8. Get from an empty .github/workflows to a green check.

    Then Create the workflow in a scratch repository and watch it run.

  9. Choose the right event and filter for each job.

    Then Add a path filter to yesterday's workflow and observe what does not run.

  10. Read any context; never interpolate untrusted text into `run:`.

    Then Print `toJSON(github.event)` through `env:` once and read it.

  11. Build a pipeline whose every stage you ran locally first.

    Then Do the lab, including the matrix and the artifact kept on failure.

  12. Install from the lockfile with `npm ci` and understand why `npm install` is the reproducibility bug.

    Then Do the lab; watch `npm ci` refuse without a lockfile.

  13. Key a cache on what actually changes, and recognise a cache that hurts.

    Then Find one workflow with a constant cache key and fix it.

  14. Prove your test stage runs — because by default it may not.

    Then Do the lab: build a broken test with exit 0, then gate on `--target test`.

  15. Diagnose failures whose error messages point the wrong way.

    Then Do the lab: merge base, permissions, skipped checks, cache keys. If a regression is in Git rather than CI, the bisect lab (18) is the tool.

  16. Declare permissions; know what `actions: write` hands an attacker.

    Then Set the organisation default token permission to read-only, or find out why you cannot.

  17. Recognise injection and the `pull_request_target` trap.

    Then Do the lab: four real vulnerability classes in one file.

  18. Pin third-party actions to a SHA and keep them updated.

    Then Pin every third-party action in one workflow and enable Dependabot for Actions.

  19. Replace a stored cloud key with a per-run token and a trust policy that restricts.

    Then Do the lab, including proving the broad trust policy admits any repository.

  20. Scope secrets to environments; know what masking does and does not do.

    Then Move one production secret from repository scope to an environment with required reviewers.

  21. Gate deployments on reviewers and rules.

    Then Add a production environment with one required reviewer to a deployment workflow.

  22. Stop the secret before it is committed.

    Then Enable push protection on one repository and test it with a fake key.

  23. Rotate first; then rewrite, knowing what the rewrite does not fix.

    Then Run `git log --all -p -S` for a known-bad string in a repository you own.

  24. Know exactly what a signature proves.

    Then Register an SSH signing key and sign one commit.

  25. See the chain of custody from source to artifact and where each link can break.

    Then Generate an SBOM for one build artifact.

  26. Attest what your pipeline built and verify it before deployment.

    Then Add `attest-build-provenance` to one release workflow.

  27. Put the plan on the pull request; read `-/+` as a reviewer.

    Then Do the lab, no cloud account needed.

  28. Apply the four-principle litmus test to your own pipeline.

    Then Score your deployment pipeline against the four principles.

  29. Ship a reviewable, reconciled infrastructure change.

    Then Do the lab.

  30. Review an AI-authored change as a contribution from a competent stranger.

    Then Take the readiness assessment for your team, and pick the learning path it recommends.