CI CD
84 bites tagged CI CD — interview questions with model answers, and 60-second explainers.
How would you enforce WCAG 2.1 AA compliance across CI/CD?
Layer axe-core in unit tests, Playwright Axe in CI, visual regression for focus states, and gate deploys on severity. Layered a11y automation across build and deploy. One post-build audit, not distributed checks.
Design an automated system to validate tutorial snippets against new releases
Separate API docs from other snippets; run CI on new dependency versions; inject secrets via hooks. Auto-validating docs when libraries release updates. Manual checks or credentials in markdown.
What is Git LFS and what are its CI/CD trade-offs?
This tests whether you understand Git's object model limits. A strong answer covers pointer indirection, smudge filters, and the shift of download burden to the LFS server in CI. A red flag is claiming LFS eliminates large file transfers entirely.
How do you implement security policies as code across CI pipelines?
This tests operationalizing Policy as Code for security scanners at scale. Strong answers cover centralized version-controlled rules consumed by CI pipelines with automated gates and exception workflows. Red flag: teams maintaining independent scanner configs.
How would you instrument CI/CD to measure a DORA metric accurately?
Tests mapping DORA definitions to pipeline events. A strong answer picks one metric, defines exact boundaries from merge to production, and correlates deployments with incidents.
How do you investigate and resolve a critical transitive dependency vulnerability?
It tests transitive CVE triage. A strong answer reproduces the finding, traces the dependency path, upgrades the direct dependency if possible, and considers build-tool overrides otherwise. Red flag: ignoring it as transitive or blind upgrades without tests.
Prevent developer access to production secrets while preserving debuggability
Use dynamic short-lived credentials, break-glass with dual-control audit, and structured telemetry or synthetic transactions for debugging. Architecture keeping production plaintext secrets invisible to developers.
Why avoid committing secrets to Git, and secure local alternatives?
This tests basic secret hygiene and environment isolation. A strong answer notes Git history is immutable and distributed, so secrets persist in forks forever, and proposes environment variables or gitignored dotenv files.
How do you manage secrets within IaC configurations?
This tests secret injection and the security-complexity tradeoff in IaC. A strong answer contrasts a cloud secret manager with encrypted files or env vars, covering rotation and blast radius. A red flag is plaintext secrets in Git or state files.
Explain dependency management and diamond conflicts in automated builds
Tests transitive dependency resolution and conflict strategies in build pipelines. Strong answers mention nearest-wins eviction, strict versioning, shading, or classloader isolation. Red flag: manual jar swaps or pinning without understanding ABI breakage.
How do build tools differ from compilers or interpreters?
This tests whether you see compilation as only one step in a repeatable pipeline. A strong answer covers dependency resolution, transitive libraries, task automation, and artifact packaging.
Describe Trunk-Based Development principles and CI/CD benefits
Tests if you view TBD as a CI/CD enabler versus GitFlow. Good answers name a single trunk, branches under 24 hours, pre-integrate builds, and feature flags, tying daily commits to releasable code and less merge hell. Red flag: endorsing long-lived branches.
Describe using a pre-push Git hook for checks and its CI limitations.
It tests client-side automation versus server-side policy. An executable .git/hooks/pre-push script runs tests and exits non-zero to block, noting hooks are not cloned, skipped via --no-verify, and local-only. A red flag is treating them as policy gate.
IAST: Inside-Out Runtime Security Scanning
IAST is an inside-out security scanner: an agent in your running app watches data flow to catch vulnerabilities with few false positives. It runs during functional tests, giving precise line-of-code findings. If your tests skip a route, IAST stays blind to it.
Propose a multi-sprint strategy to fix an inverted test pyramid
Audit E2E for redundancy; scaffold unit/integration tests; migrate per sprint, keep critical E2E; gate on fast feedback. Refactoring under delivery pressure. Big-bang rewrites or deleting all E2E without a safety net.
Describe the relationship between Jidoka and TDD/CI
Jidoka is stop-the-line; map TDD to unit detection and CI to build verification; show shift-left. Linking Lean quality control to software feedback loops. Treating them as separate or equating Jidoka with manual QA.
Nexus Integration Team vs. Traditional Integration Teams
Tests your grasp of scaled Agile's shift from phase-gate integration to shared ownership. Contrast the NIT as a coach for continuous integration with a traditional team's gatekeeper role.
How do CI and testing support the Scrum value of Commitment?
Tests if you can connect technical practices to business value. A great answer links CI/CD to the 'Definition of Done' and explains how automated tests de-risk the sprint commitment.
Technical Prerequisites for LeSS Feature Teams
This tests your grasp of the engineering practices that enable agile scaling. A great answer covers continuous integration for shared ownership, robust test automation, and a loosely coupled architecture. A red flag is focusing only on Scrum ceremonies.
Relate 'Build Quality In' (Jidoka) to TDD and CI
Tests your ability to connect abstract Lean principles to concrete practices. A great answer defines Jidoka (stop the line on defect), then links TDD as the micro-level check and CI as the macro-level automated line-stop. A red flag is just defining the terms.
fastlane for React Native: Automating Native Builds
fastlane automates the native build and release steps for your React Native app. It scripts Xcode and Gradle tasks like code signing and uploading to stores, letting you ship from one command. The footgun: it only automates native toolchains, not JS bundling.
Expo Application Services (EAS): The Cloud Toolchain for React Native
Expo Application Services (EAS) is the cloud toolchain for production React Native apps. It handles complex native builds, app store submissions, and over-the-air updates. The main footgun is confusing it with the local `expo` CLI for development.
CI/CD Pipelines for Node.js Applications
A CI/CD pipeline is an automated assembly line for Node.js code, installing dependencies, running tests, and packaging your app for deployment. This is standard for any professional project, but a common footgun is not caching dependencies, leading to slow…
Code Coverage Reporting with nyc/Istanbul
Code coverage reporting asks, "Which lines of my code did my tests actually run?" Use a tool like `nyc` to wrap your test runner (e.g., Mocha) and generate a report. The footgun is chasing 100% coverage, which doesn't guarantee quality.
Get CI CD bites daily.
Five a day, five minutes, offline. With quizzes so it sticks.
Open testing — you’ll join as an early tester.