08Walk me through what happens between a developer pushing a commit and a job starting on a runner.▼medium★ EssentialNewMicrosoftAccentureInfosysunlockedMost candidates narrate the YAML. The scoring starts underneath: who schedules what, where artifacts live between jobs, and why disposable runners rewrite how you think about caching and trust.Open full answer →
20A stranger opens a pull request from their fork. What can that PR execute in your pipeline, and where does pull_request_target go wrong?▼hard★ EssentialNewCloudflareGitLabStripe○ sign inPublic fork PRs normally get a read-only token and no repository secrets. Privileged triggers, runner access and untrusted shell input can break that boundary.Open full answer →
46Production deploys must use an approved reusable workflow. How do you enforce that in GitHub OIDC trust?▼hardNewGitLabMicrosoftAtlassian◆ premiumA token naming the right repository does not prove that the approved deployment workflow ran. Bind the caller, deployment context and called workflow into the cloud trust contract.Open full answer →
