Git in CI/CD and DevOps¶

Overview¶

Git is the trigger, transport, and source of truth for modern DevOps delivery. Every push fires webhooks; every merge runs pipelines; every tag deploys to production. GitOps operators reconcile Kubernetes clusters against Git branches. This finale tutorial connects everything you've learned — workflow, hooks, signing, remotes — to the CI/CD and GitOps patterns used in production.

This is Tutorial 20 in Module 6: Advanced & DevOps — the finale of the REBASH Academy Git series.

Prerequisites¶

• Signed Commits and Git Security
• Git Hooks and Automation
• Working with Remotes
• Pull Requests and Code Review

Learning Objectives¶

By the end of this tutorial, you will be able to:

• Explain how Git events trigger CI/CD pipelines
• Configure pipeline triggers for push, PR, and tag events
• Implement GitOps with pull-based deployment models
• Pin deployments to commit SHAs and signed tags
• Design repository layout for IaC and application delivery
• Integrate Git with Terraform Cloud, GitHub Actions, and GitLab CI
• Apply complete Git hygiene across the DevOps lifecycle

DevOps Git Pipeline Diagram¶

flowchart TB
    DEV["Developer Push / PR"]
    GIT["(Git Repository")]
    WH["Webhook / Event"]
    CI["CI Pipeline<br/>build · test · scan"]
    ART["Artifact Registry<br/>image · plan"]
    CD["CD / GitOps<br/>Argo CD · Flux"]
    PROD[Production]

    DEV --> GIT
    GIT --> WH --> CI
    CI --> ART
    GIT --> CD
    CD --> PROD
    ART --> PROD```

## Theory

### Git as the System of Record

In DevOps, Git stores:

| Asset | Example path |
|-------|--------------|
| Application source | `src/`, `cmd/` |
| Infrastructure | `terraform/`, `pulumi/` |
| Kubernetes manifests | `k8s/overlays/prod/` |
| CI definitions | `.github/workflows/`, `.gitlab-ci.yml` |
| Policies | `policy/`, OPA Rego |
| Runbooks | `docs/runbooks/` |

If it affects production, it belongs in Git — not wikis or chat.

### CI Trigger Events

| Event | Typical pipeline action |
|-------|-------------------------|
| **Push to feature branch** | Lint, unit tests |
| **Pull request opened/updated** | Full test + plan + security scan |
| **Merge to main** | Build artifact, deploy staging |
| **Tag v*.*.*** | Deploy production |
| **Schedule** | Drift detection, dependency updates |

Webhooks deliver events from Git host to CI within seconds.

### Pipeline Git Operations

CI runners commonly:

```bash
git clone --depth 1 --branch "$BRANCH" "$REPO_URL" workspace
cd workspace
git rev-parse HEAD   # pin SHA in logs and artifacts

Advanced patterns:

• Merge ref checkout for PRs (refs/pull/123/merge)
• Submodule init for nested dependencies
• LFS pull for large assets
• Sparse checkout for monorepos

Commit SHA as Deployment Identity¶

Immutable reference for traceability:

myapp:1.4.2@sha-a1b2c3d4

Kubernetes deployment annotation:

metadata:
  annotations:
    git.commit/sha: a1b2c3d4e5f6789...
    git.commit/message: "fix: patch CVE-2026-1234"

Rollback = redeploy previous SHA or revert commit in Git.

GitOps — Pull-Based Deployment¶

Push-based CD: CI pipeline pushes/applies changes to cluster (kubectl apply from runner).

GitOps (pull-based): Operator in cluster watches Git; reconciles desired state:

Benefits:

• Cluster pulls changes — no CI cluster credentials
• Drift detection — live vs Git diff
• Audit trail in Git history
• Rollback via Git revert

Example Argo CD Application:

apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: payment-service
spec:
  source:
    repoURL: https://github.com/org/k8s-manifests.git
    targetRevision: main
    path: overlays/production/payment
  destination:
    server: https://kubernetes.default.svc
    namespace: payment
  syncPolicy:
    automated:
      prune: true
      selfHeal: true

Repository Layout Patterns¶

Polyrepo: App repo + separate infra repo — clear boundaries.

Monorepo: App + infra + CI in one repo — atomic changes, complex CI.

Environment overlays (Kustomize):

k8s/
  base/
  overlays/
    dev/
    staging/
    production/

Git branch != environment; path or overlay selects environment.

Terraform + Git Integration¶

Terraform Cloud/Enterprise:

• VCS-driven workflow connects GitHub/GitLab
• PR triggers speculative plan posted as comment
• Merge to main triggers apply (if approved)

Local alternative — CI runs:

terraform init
terraform plan -out=plan.tfplan
terraform apply plan.tfplan   # main branch only

State backends (S3 + DynamoDB) separate from Git — never commit state files.

GitHub Actions Example¶

name: CI
on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Verify signed commits
        run: |
          git log --format='%G?' -1 | grep -q G || exit 1
      - name: Terraform plan
        run: |
          terraform init -backend=false
          terraform validate
          terraform plan -detailed-exitcode

GitLab CI Example¶

stages:
  - validate
  - plan
  - apply

terraform-plan:
  stage: plan
  script:
    - terraform init
    - terraform plan -out=plan.cache
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

terraform-apply:
  stage: apply
  script:
    - terraform apply -auto-approve plan.cache
  rules:
    - if: $CI_COMMIT_BRANCH == "main"

Security Integration Recap¶

Full stack from this track:

1. Signed commits — identity verification
2. Branch protection — no direct push to main
3. PR review — human gate
4. Pre-commit hooks — local lint/secrets
5. CI scanning — SAST, IaC policy, container scan
6. GitOps — cluster reconciles only from trusted repo/branch

Multi-Repository Orchestration¶

Platform teams manage:

• App repos — microservices
• GitOps repo — Kustomize/Helm values updated by CI (image tag bump commit)
• Terraform repo — cloud foundation

CI in app repo commits SHA update to GitOps repo — classic pattern:

git clone git@github.com:org/gitops.git
cd gitops/apps/payment
kustomize edit set image payment=$IMAGE:$CI_COMMIT_SHA
git commit -am "deploy: payment $CI_COMMIT_SHA"
git push

Argo CD detects change and syncs.

Observability and Git¶

Link deployments to commits in:

• Datadog/Sentry release tracking — version = Git SHA
• Incident tools — "what commit is prod?" query
• Changelog automation — conventional commits → release notes

Hands-on Lab¶

Step 1 – Simulate CI checkout¶

Command:

mkdir -p /tmp/git-cicd-lab && cd /tmp/git-cicd-lab
git init -b main
echo "app_version=1.0" > app.env
git add . && git commit -m "feat: initial release"
git init --bare /tmp/cicd-remote.git
git remote add origin /tmp/cicd-remote.git
git push -u origin main
SHA=$(git rev-parse HEAD)
echo "Deploy identity: myapp@$SHA"

Step 2 – Tag production release¶

Command:

git tag -a v1.0.0 -m "Production release 1.0.0"
git push origin v1.0.0
git show v1.0.0 --no-patch --format="Tag %D points to %H"

Step 3 – Simulate PR merge workflow¶

Command:

git switch -c feature/ci-demo
echo "app_version=1.1" > app.env
git commit -am "feat: bump version for CI demo"
git push -u origin feature/ci-demo
git switch main
git merge --no-ff feature/ci-demo -m "Merge PR #42: CI demo"
git push origin main
git log --oneline --graph -5

Step 4 – Simulate GitOps manifest update¶

Command:

mkdir -p k8s/overlays/prod
cat > k8s/overlays/prod/kustomization.yaml << EOF
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - deployment.yaml
images:
  - name: myapp
    newTag: ${SHA:0:7}
EOF
echo "apiVersion: apps/v1" > k8s/overlays/prod/deployment.yaml
git add k8s/ && git commit -m "deploy: pin image to ${SHA:0:7}"
git log -1 --format="GitOps commit %h — image tag %s"

Step 5 – Pipeline preflight script¶

Command:

cat > ci-preflight.sh << 'EOF'
#!/usr/bin/env bash
set -euo pipefail
echo "Commit: $(git rev-parse HEAD)"
echo "Branch: $(git rev-parse --abbrev-ref HEAD)"
echo "Signed: $(git log -1 --format='%G?')"
test -f app.env && echo "Config: $(cat app.env)"
EOF
chmod +x ci-preflight.sh
./ci-preflight.sh

Step 6 – Clean up¶

Command:

cd /tmp && rm -rf git-cicd-lab cicd-remote.git

Commands & Code¶

Complete DevOps Git checklist¶

## Repository Setup
- [ ] main protected; PR required
- [ ] Signed commits enforced
- [ ] .gitignore for stack
- [ ] pre-commit hooks configured
- [ ] CODEOWNERS defined

## CI Pipeline
- [ ] Trigger on PR and main push
- [ ] Pin checkout to event SHA
- [ ] terraform plan / k8s validate
- [ ] Secret and IaC policy scan
- [ ] Post plan to PR comment

## CD / GitOps
- [ ] Deploy staging on main merge
- [ ] Deploy prod on signed tag
- [ ] GitOps operator watches prod path
- [ ] Rollback = revert or previous tag
- [ ] Deployment annotated with commit SHA

Common Mistakes¶

Best Practices¶

Troubleshooting¶

Summary¶

• Git events (push, PR, tag) trigger CI/CD pipelines via webhooks
• Commit SHA and signed tags provide immutable deployment identity
• GitOps pulls desired state from Git — Argo CD and Flux reconcile clusters
• Separate plan (PR) from apply (main/tag) for IaC safety
• Complete Git track skills — workflow, hooks, signing, remotes — integrate here
• Git is step 3 in the DevOps learning path; apply it with GitLab CI/CD, Terraform, and platform tooling

Interview Questions¶

1. How do Git push events trigger CI pipelines?
2. What is GitOps, and how does it differ from traditional CI/CD push deploy?
3. Why pin deployments to commit SHA rather than branch name?
4. What Git events should trigger terraform plan vs apply?
5. Describe the app repo → GitOps repo → cluster flow.
6. What belongs in Git vs artifact registry vs state backend?
7. How do you roll back a GitOps deployment?
8. What security controls should protect the production Git branch?
9. How do signed tags integrate with release pipelines?
10. What is the complete Git hygiene checklist for a DevOps team?

Related Tutorials¶

• Signed Commits and Git Security (previous)
• Git Hooks and Automation
• Advanced Git Workflows
• Pull Requests and Code Review
• Git – Category Overview — track complete
• GitLab CI/CD Overview
• Terraform Overview
• Learning Paths – DevOps Engineer

References¶

• CNCF GitOps Working Group
• Argo CD Documentation
• Flux Documentation
• GitHub Actions – Events that trigger workflows
• Terraform Cloud VCS-driven workflow
• DORA Metrics and version control
• Pro Git Book – entire book
• REBASH Academy – Git Overview

Congratulations¶

You have completed all 20 tutorials in the REBASH Academy Git track — from version control fundamentals through CI/CD and GitOps integration. Return to the Git Overview to review the curriculum or continue to GitLab CI/CD and Terraform in the DevOps learning path.