Summary

# CI/CD summary

You can now:

- Design a pipeline: lint, build, test, package, deploy
- Cache dependencies and build outputs across runs
- Run matrix builds across versions and platforms
- Sign artifacts and verify provenance (SLSA, in-toto, Sigstore)
- Promote between environments with progressive delivery (canary, blue-green)
- Use feature flags so deploy and release decouple
- Roll back fast and observe rollouts with golden signals
- Manage secrets with OIDC trust to your cloud instead of long-lived keys

# Your next step - a GitHub Actions OIDC workflow

name: Deploy
on:
  push:
    branches: [main]

permissions:
  id-token: write
  contents: read

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment: production
    steps:
      - uses: actions/checkout@v4
      - uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: arn:aws:iam::111111111111:role/GhActionsDeploy
          aws-region: ap-southeast-2
      - run: aws s3 sync ./dist s3://my-site --delete
      - run: aws cloudfront create-invalidation --distribution-id ABC --paths '/*'

# Next: progressive delivery, GitOps (Argo / Flux), supply-chain (SLSA, signed builds).