Untitled Lesson
Skill Matrix
UNLOCK NODES BY LEARNING NEW TAGS.
Why is `npm ci` used in a CI pipeline's install step, rather than `npm install`?
💻 Code Challenge | +75 XP
Write a CI pipeline configuration (in the style of GitHub Actions YAML) with dependency caching keyed by the lockfile hash, running npm ci, lint, type-check, and tests in a fail-fast order, and a separate deploy job triggered only on merges to main.
A team's CI pipeline was passing consistently in CI but a deployed change still broke production, traced to a required environment secret being hardcoded incorrectly in a pipeline config file committed to the repository. Reorder the steps to fix this security issue.
Task: Reorder the blocks in logical sequence to solve the problem.
A.D.A. Interface
Adaptive Didactic Assistant
Pascual Vila
Frontend Instructor // Code Syllabus
The Error //
Hardcoding a secret value (an API key, a deploy credential) directly in a CI/CD pipeline configuration file
// Wrong: permanently exposed in git history
env:
API_KEY: "sk_live_abc123..."
// Correct: referenced from the CI platform's secure secret store
env:
API_KEY: ${{ secrets.API_KEY }}The Solution //
A pipeline configuration file is typically committed to version control alongside the application code, meaning a hardcoded secret is permanently exposed in git history to anyone with repository access — use the CI platform's dedicated secrets management feature instead, referencing the secret by name rather than embedding its actual value.
The Error //
Not requiring CI checks to pass before allowing a pull request to be merged
// Without branch protection: CI is informational only, merge proceeds regardless
// With branch protection: "Require status checks to pass before merging"
// A failing CI pipeline BLOCKS the merge entirelyThe Solution //
Without an enforced branch protection rule requiring CI to pass, a passing (or even failing) CI pipeline remains purely informational — a developer can still merge a change with failing tests or a broken build, defeating much of the purpose of having CI checks in the first place.