Build once, promote the same artefact, and prove it is the same

short · 50 min · Objective 5.3

Task

The rule is build once and promote the identical artefact. Build a pipeline that does it, then build one that rebuilds per environment and show that the two artefacts differ -- which means the thing you tested is not the thing you deployed.

Steps

  1. Write a pipeline that builds a container image, records its DIGEST, and deploys it to a 'staging' and then a 'production' namespace using that digest both times. Record both digests in lab/cicd/promote.md.
  2. Confirm the two digests are identical and that configuration differed only by environment values supplied at deploy time.
  3. Now write the wrong version: rebuild the image separately for each environment. Record both digests.
  4. Compare the two digests from step 3. If they match, introduce anything that varies between builds -- a timestamp, a dependency resolved at build time -- and record that they now differ.
  5. Write the consequence in one paragraph: what it means for testing when the artefact promoted is not the artefact tested.

Verify

grep -Ec 'sha256:' lab/cicd/promote.md
grep -Eci 'identical|same digest' lab/cicd/promote.md
grep -Eci 'differ|not identical' lab/cicd/promote.md
grep -Eci 'configuration|environment value' lab/cicd/promote.md

At least four digests recorded, with one pair identical and one pair differing. That contrast is the whole lab.

This is an independent study companion for CompTIA Cloud+ CV0-004 and is not produced by or endorsed by CompTIA.