GitLab Orbit unifies code lifecycle in live graph
GitLab Orbit beta unifies code, pipelines, and ownership in a live graph. Compare the Market tests show Orbit-grounded reviewers hit 70% accuracy versus 58% for RAG.
GitLab patches 13 CVEs including SAML account takeover flaw
GitLab 19.0.2, 18.11.5, and 18.10.8 patch 13 security flaws, including four High-severity CVEs like SAML account takeover (CVSS 8.7) and unauthenticated API DoS. Self-managed instances must upgrade immediately; GitLab.com is already patched.
Design a golden path CI/CD pipeline for a Go API
WHAT IT TESTS: Balancing standardization with team autonomy. ANSWER OUTLINE: Propose build, test, SAST, containerize, deploy stages with hooks or config overlays for flexibility. RED FLAG: A rigid pipeline with no escape hatches or weak security gates.
Design a workflow for managing security scanner vulnerabilities
This tests scaling security without developer noise fatigue. A strong answer covers centralized ingestion, severity SLAs with exploitability, auto-triage rules, and CI gates on critical findings only. A red flag is forcing manual review of all scanner output.
What strategies reduce DAST scan time while maintaining security coverage?
It tests balancing security depth with CI velocity through DAST tuning. A strong answer covers incremental scans, parallel workers, scoped targets, and shift-left complements.
Design short-lived dynamic database credentials and their security benefits
This tests automated least-privilege credential lifecycle design. A strong answer covers a secrets broker with database plugins, short TTL leases tied to workload identity, and automatic revocation. Red flag: manual rotation or long-lived CI variables.
How would you create and distribute reusable IaC components at scale?
This tests platform engineering governance at scale. A strong answer proposes a versioned module registry, policy-as-code guardrails, automated validation pipelines, and self-service documentation.
What is an artifact repository and why not just a shared filesystem?
Tests your grasp of immutability, metadata, and access control for build artifacts. A strong answer covers versioning, checksums, RBAC, and API retrieval that NFS lacks. Red flag: saying a shared filesystem is simpler and therefore enough for production.
Design a selective build strategy for a large monorepo
Tests monorepo dependency graph reasoning. Good answers model a DAG, compute reverse deps of the changed library, rebuild only affected targets via Bazel or Nx, and cache remotely. Red flag: directory triggers, full rebuilds, or testing the library alone.
What is static analysis in automated builds, with examples?
This tests if you treat static analysis as a pre-runtime quality gate. A strong answer says it shifts feedback left via non-execution scans, citing cyclomatic complexity or unhandled promise rejections.
What is Git LFS and what are its CI/CD trade-offs?
This tests whether you understand Git's object model limits. A strong answer covers pointer indirection, smudge filters, and the shift of download burden to the LFS server in CI. A red flag is claiming LFS eliminates large file transfers entirely.
Explain .gitignore and its impact on faster, reliable, secure CI builds
WHAT IT TESTS: whether you see VCS hygiene as a CI speed, reliability, and security control. ANSWER OUTLINE: exclude build artifacts to shrink clones and stabilize cache keys; block secrets from runners. RED FLAG: dismissing it as local convenience.
How do you add a basic post-deployment health check in CI/CD?
Tests deployment validation beyond exit-code success. Outline: add a post-deploy stage that probes an HTTP endpoint, checks status code and latency, validates critical dependencies, and triggers rollback on failure.
How do you implement security policies as code across CI pipelines?
This tests operationalizing Policy as Code for security scanners at scale. Strong answers cover centralized version-controlled rules consumed by CI pipelines with automated gates and exception workflows. Red flag: teams maintaining independent scanner configs.
How would you add E2E tests to CI and what challenges arise?
This tests CI/CD pipeline design. Cover Dockerized environments, parallel runs, flaky-test retries, and selective execution such as critical tests per commit and full suites nightly. Red flag: running all tests on every commit without isolation or retries.
How do you keep one build artifact immutable across environments?
This tests separation of build and run stages. A strong answer packages one artifact with zero embedded config, then injects env vars or mounted secrets at deploy time via the platform. Red flags include per-stage rebuilds or config baked into the image.
How would you implement zero-downtime secrets rotation?
WHAT IT TESTS: rotating credentials without downtime. OUTLINE: inventory secrets and app caching; baseline monitoring; dual-phase rotation with overlapping secrets; verify before revoking old.
.webp&w=1600&q=75)
How would you design an automated artifact repository cleanup policy?
WHAT IT TESTS: Balancing cost, compliance, and speed via tiered artifact retention. A strong answer covers age rules, deployment state, protected tags, and dry-run gates.
Compare monorepo and polyrepo strategies in CI/CD
Tests repo structure impact on builds, dependencies, and pipeline triggers. Contrast monorepo atomicity with polyrepo autonomy; cover monorepo change-detection versus polyrepo versioning and contract tests.
Design a dynamic, risk-based quality gate system
Tests if you can move CI/CD from binary pass/fail to contextual risk scoring. Strong answers define criticality tiers, weight signals by severity and blast radius, and emit GO/CAUTION/STOP states.