Cheat Sheets

Three dense quick references by persona—daily developer CI workflows, platform deploy/promote operations, and security scanning plus policy-as-code commands. Use Copy sheet for plain text or persona filters to focus one role.

developer devops security Cosign Trivy

Developer Cheat Sheet

Local workflows, PR feedback, security scans before push, Helm/Kustomize dry-runs. Chapters: CI Pipelines, Source Control.

developer

Daily pipeline & git commands

Task	Command	Notes
Run tests locally	`make test`	Mirror CI target
Lint before push	`pre-commit run --all-files`	Same rules as pipeline
Debug CI locally	`act -j build`	GitHub Actions emulator
Check PR CI status	`gh pr checks 1842`	Requires gh CLI auth
View workflow runs	`gh run list --workflow=ci.yml`	Filter: --branch=feature/x
Re-run failed jobs	`gh run rerun RUN_ID --failed`	After fixing infra flake
Clone with depth	`git clone --depth=1`	Faster CI checkout
Signed commit	`git commit -S -m 'fix: auth'`	GPG or SSH sig
View SARIF in PR	`Open Security tab`	GitHub code scanning
Cosign verify image	`cosign verify --certificate-oidc-issuer REGISTRY_IMAGE:tag`	Before deploy
Trivy scan locally	`trivy image --severity HIGH,CRITICAL myapp:dev`	Catch before push
Semgrep local	`semgrep scan --config=auto`	SAST in IDE terminal
Check secret leak	`gitleaks detect --source .`	Pre-commit hook
Helm template dry-run	`helm template api ./chart -f values-staging.yaml`	Render without cluster
Kustomize build	`kubectl kustomize overlays/staging`	Validate overlays
Port-forward staging	`kubectl port-forward svc/api 8080:80 -n staging`	Debug without ingress
Fetch pod logs	`kubectl logs -f deploy/api -n staging --tail=200`	Since deploy
Exec debug shell	`kubectl exec -it deploy/api -n staging -- /bin/sh`	Ephemeral debug
Diff cluster vs git	`argocd app diff api-staging`	Drift before merge
Trigger review app	`gh pr create --fill`	Opens PR → CI deploys preview

Environment variables (twelve-factor)

Task	Command	Notes
ENV	`LOG_LEVEL=debug`	Non-secret config
DATABASE_URL	`vault://secret/dev/db`	Never in .env committed
FEATURE_X	`true`	Prefer feature flag service
OTEL_SERVICE_NAME	`api`	Tracing resource attr
CI=true	`set by runner`	Detect CI in scripts

Pre-commit hook (.pre-commit-config.yaml)

repos:
  - repo: https://github.com/gitleaks/gitleaks
    rev: v8.18.4
    hooks:
      - id: gitleaks
  - repo: https://github.com/returntocorp/semgrep
    rev: v1.72.0
    hooks:
      - id: semgrep
        args: ['--config', 'p/ci', '--error']
  - repo: local
    hooks:
      - id: unit-tests
        name: unit tests
        entry: make test
        language: system
        pass_filenames: false

Makefile targets (CI parity)

.PHONY: test lint scan build
test:
	pytest -q --tb=short
lint:
	ruff check . && ruff format --check .
scan:
	trivy fs --severity HIGH,CRITICAL .
build:
	docker build -t $(APP):$(GIT_SHA) .

💡 Tip

Run make lint test scan before every push. If local passes, CI failure is infra—not your code.

DevOps / Platform Cheat Sheet

Deploy, promote, rollback, GitOps sync, pipeline metrics, registry operations. Chapters: Deployment, Environments.

devops

CI/CD & deploy operations

Task	Command	Notes
List workflows	`gh workflow list`	GitHub
Dispatch workflow	`gh workflow run promote.yml -f image_digest=sha256:abc`	Manual promote
GitLab pipeline	`glab ci view`	Live pipeline status
Retry GitLab job	`glab ci retry JOB_ID`	After runner recovery
Push to ECR	`aws ecr get-login-password \| docker login …`	OIDC preferred in CI
Sign image	`cosign sign --yes IMAGE@DIGEST`	Keyless with Fulcio
Copy image cross-account	`crane copy SRC DST`	Promotion between registries
Helm upgrade	`helm upgrade --install api ./chart -n prod -f values-prod.yaml --atomic`	Rollback on failure
Helm rollback	`helm rollback api 41 -n prod`	Previous revision
ArgoCD sync	`argocd app sync api-prod --prune`	GitOps deploy
ArgoCD rollback	`argocd app rollback api-prod 12`	To previous git revision
Kubectl rollout status	`kubectl rollout status deploy/api -n prod --timeout=300s`	Wait for deploy
Drain node	`kubectl drain NODE --ignore-daemonsets --delete-emptydir-data`	Pre-upgrade
Apply Kyverno policy	`kubectl apply -f policies/verify-images.yaml`	Admission verify
Terraform plan in CI	`terraform plan -out=plan.tfplan`	PR comment with summary
Atlantis apply	`atlantis apply -p prod`	After approved PR
Vault login OIDC	`vault login -method=oidc`	Human break-glass
ESO refresh secret	`kubectl annotate es api-db force-sync=$(date +%s)`	Force ExternalSecret sync
Pushgateway metric	`echo 'ci_build_duration_seconds 142' \| curl --data-binary @- PUSHGATEWAY/metrics/job/ci`	Pipeline metrics
Promote GitLab env	`glab ci run --branch main deploy:production`	Manual prod job

Promotion one-liner (digest pin)

# Promote verified digest to prod overlay
DIGEST=sha256:abc123...
yq -i ".image.digest = \"$DIGEST\"" deploy/overlays/prod/values.yaml
git commit -am "promote: $DIGEST" && git push
argocd app sync api-prod --timeout 600

Pipeline failure triage

Stage red	First command	Common fix
lint	Run linter locally	Auto-format, commit fix
unit test	pytest -k failing_test	Fix or quarantine flake
SAST	semgrep --config=ruleid	Fix or document waiver
container scan	trivy image IMAGE	Base image upgrade
deploy	kubectl describe pod -n ns	ImagePullBackOff, OOM, probe
policy	kyverno policy report -n ns	Missing signature, resource limit

🔬 Under the Hood

helm upgrade --atomic rolls back automatically if hooks or readiness fail—use on prod to avoid half-upgraded releases.

Security Engineer Cheat Sheet

SAST, SCA, secret scanning, image signing, policy-as-code, runtime checks. Chapters: Security Scanning, Policy as Code.

security

Scanning & supply chain commands

Task	Command	Notes
Trivy fs scan	`trivy fs --scanners vuln,secret,misconfig .`	Repo + IaC
Trivy image CI gate	`trivy image --exit-code 1 --severity CRITICAL,HIGH IMAGE`	Block pipeline
Grype SBOM scan	`grype sbom:./sbom.json`	From Syft SBOM
Syft generate SBOM	`syft packages IMAGE -o spdx-json > sbom.json`	Attach to release
Semgrep CI	`semgrep ci --config p/ci`	PR blocking rules
Gitleaks history	`gitleaks detect --source . --log-opts='--all'`	Full git history
Conftest K8s	`conftest test -p policy/ deploy.yaml`	OPA/Rego policies
Cosign verify policy	`cosign verify --certificate-identity-regexp .* IMAGE`	Sigstore
SLSA provenance	`slsa-verifier verify-artifact ARTIFACT --provenance-path provenance.intoto.jsonl`	Supply chain
OPA eval	`opa eval -d policy.rego 'data.kubernetes.admission.deny'`	Test Rego locally
Kyverno test	`kyverno test ./tests/`	Policy unit tests
Checkov IaC	`checkov -d terraform/`	Terraform misconfig
tfsec	`tfsec terraform/`	Alternative IaC scanner
Falco alert	`kubectl logs -n falco -l app=falco`	Runtime threats
Network policy test	`kubectl run test --rm -it --image=nicolaka/netshoot -- curl target`	Verify deny
RBAC audit	`kubectl auth can-i --list --as=system:serviceaccount:prod:api`	SA permissions
SAST SARIF upload	`gh api repos/OWNER/REPO/code-scanning/sarifs -f [email protected]`	GitHub Security
Dependency review	`gh api dependency-graph/snapshots`	Transitive vulns
Vault policy write	`vault policy write ci-read - <`	Least privilege CI
Rotate leaked secret	`1. Revoke 2. Rotate in vault 3. gitleaks allowlist false positive`	Incident playbook

Kyverno verifyImages policy

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: verify-signed-images
spec:
  validationFailureAction: Enforce
  rules:
    - name: verify-cosign
      match:
        any:
          - resources:
              kinds: [Pod]
      verifyImages:
        - imageReferences: ["123456789012.dkr.ecr.us-east-1.amazonaws.com/*"]
          attestors:
            - entries:
                - keyless:
                    subject: "https://github.com/org/repo/.github/workflows/*"
                    issuer: "https://token.actions.githubusercontent.com"

Severity response matrix

Severity	SLA	Pipeline action	Exception process
Critical	24h fix or block	Fail build (--exit-code 1)	CISO waiver + ticket
High	7 days	Warn + Jira auto-create	Risk acceptance doc
Medium	30 days	Report only	Backlog prioritization
Low	90 days	SBOM attach	No exception needed

🔒 Security

Never waive Critical findings without expiry date and compensating control documented. Waivers without TTL become permanent vulnerabilities.

GitHub Actions quick flags

Flag / syntax	Purpose
`if: always()`	Run step even when job fails (metrics upload)
`needs: [job-a]`	DAG dependencies between jobs
`environment: production`	Approval gate + secrets scope
`concurrency: group: deploy`	Cancel in-progress duplicate deploys
`permissions: id-token: write`	OIDC for AWS/GCP without static keys

GitLab CI quick reference

# Stages run in order; jobs in same stage parallel
stages: [test, scan, build, deploy]

# Cache between pipelines
cache:
  key: $CI_COMMIT_REF_SLUG
  paths: [node_modules/, .venv/]

# Rules replace only/except
rules:
  - if: $CI_PIPELINE_SOURCE == "merge_request_event"
  - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

# Protected environments need Maintainer to deploy
deploy:prod:
  environment: production
  when: manual

Supply chain one-liners

Task	Command
SBOM from image	`syft packages IMAGE -o spdx-json`
Attest provenance	`cosign attest --predicate provenance.json IMAGE`
Verify in cluster	Kyverno `verifyImages` + cosign keyless
Pin action SHA	`uses: actions/checkout@b4ffde65...` not @v4

🎯 Interview Tip

Memorize the promote flow: build → scan → sign → staging → E2E → manual/auto prod with same digest. Mention cosign verify, SARIF gates, and deployment markers for rollback correlation.

Developer — extended commands

Task	Command	Notes
Install pre-commit	`pip install pre-commit && pre-commit install`	Hooks run on git commit
Run single hook	`pre-commit run gitleaks --all-files`	Debug one hook
Docker build no cache	`docker build --no-cache -t app:test .`	Reproduce CI image build
Compose up CI parity	`docker compose -f compose.ci.yml up --abort-on-container-exit`	Local integration
kubectl ctx switch	`kubectl config use-context staging`	Avoid wrong cluster deploy
Watch rollout	`kubectl rollout status deploy/api -w`	Wait for preview ready
Helm diff	`helm diff upgrade api ./chart -f values.yaml`	PR review for chart changes
ArgoCD login	`argocd login argocd.example.com --sso`	GitOps CLI
gh pr view	`gh pr view --web`	Open PR in browser
git bisect start	`git bisect start; git bisect bad; git bisect good v1.2`	Find breaking commit

DevOps — extended commands

Task	Command	Notes
Terraform fmt check	`terraform fmt -check -recursive`	CI formatting gate
Terraform validate	`terraform validate`	After init in CI
Ansible check	`ansible-playbook site.yml --check`	Dry-run changes
Pulumi preview	`pulumi preview --diff`	PR comment with diff
crane digest	`crane digest REGISTRY/image:tag`	Get sha256 for promotion
cosign download	`cosign download signature IMAGE > sig.blob`	Debug verify failure
kubectl top	`kubectl top pods -n prod --sort-by=cpu`	Post-deploy resource check
stern logs	`stern api -n prod --since 15m`	Multi-pod log tail
k9s	`k9s -n prod`	Interactive cluster UI
velero backup	`velero backup create pre-deploy-$(date +%s) --include-namespaces prod`	Pre-change snapshot

Security — extended commands

Task	Command	Notes
Nuclei scan	`nuclei -u https://staging.example.com -t cves/`	DAST quick sweep
ZAP baseline	`docker run owasp/zap2docker zap-baseline.py -t URL`	CI DAST gate
Snyk test	`snyk test --severity-threshold=high`	SCA in pipeline
pip-audit	`pip-audit -r requirements.txt`	Python dep vulns
npm audit	`npm audit --audit-level=high`	Node dep vulns
dockle lint	`dockle --exit-code 1 IMAGE`	Dockerfile best practices
hadolint	`hadolint Dockerfile`	Lint Dockerfile in CI
kube-bench	`kube-bench run --targets node`	CIS K8s benchmark
kube-hunter	`kube-hunter --remote ARGOCD_URL`	Passive K8s pentest
Falco rule test	`falco --dry-run -r custom-rules.yaml`	Validate runtime rules

Workflow snippet #1

# Emergency prod rollback (GitOps)
git revert HEAD --no-edit && git push
argocd app sync api-prod --prune --timeout 600
kubectl rollout status deploy/api -n production

# Verify cosign signature before deploy
cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com IMAGE@DIGEST

# Export pipeline metrics (Pushgateway)
echo "ci_build_duration_seconds{repo=\"org/api\"} 245" | curl --data-binary @- http://pushgateway:9091/metrics/job/ci

Workflow snippet #2

# Emergency prod rollback (GitOps)
git revert HEAD --no-edit && git push
argocd app sync api-prod --prune --timeout 600
kubectl rollout status deploy/api -n production

# Verify cosign signature before deploy
cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com IMAGE@DIGEST

# Export pipeline metrics (Pushgateway)
echo "ci_build_duration_seconds{repo=\"org/api\"} 245" | curl --data-binary @- http://pushgateway:9091/metrics/job/ci

Workflow snippet #3

# Emergency prod rollback (GitOps)
git revert HEAD --no-edit && git push
argocd app sync api-prod --prune --timeout 600
kubectl rollout status deploy/api -n production

# Verify cosign signature before deploy
cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com IMAGE@DIGEST

# Export pipeline metrics (Pushgateway)
echo "ci_build_duration_seconds{repo=\"org/api\"} 245" | curl --data-binary @- http://pushgateway:9091/metrics/job/ci

Workflow snippet #4

# Emergency prod rollback (GitOps)
git revert HEAD --no-edit && git push
argocd app sync api-prod --prune --timeout 600
kubectl rollout status deploy/api -n production

# Verify cosign signature before deploy
cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com IMAGE@DIGEST

# Export pipeline metrics (Pushgateway)
echo "ci_build_duration_seconds{repo=\"org/api\"} 245" | curl --data-binary @- http://pushgateway:9091/metrics/job/ci

Workflow snippet #5

# Emergency prod rollback (GitOps)
git revert HEAD --no-edit && git push
argocd app sync api-prod --prune --timeout 600
kubectl rollout status deploy/api -n production

# Verify cosign signature before deploy
cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com IMAGE@DIGEST

# Export pipeline metrics (Pushgateway)
echo "ci_build_duration_seconds{repo=\"org/api\"} 245" | curl --data-binary @- http://pushgateway:9091/metrics/job/ci

Workflow snippet #6

# Emergency prod rollback (GitOps)
git revert HEAD --no-edit && git push
argocd app sync api-prod --prune --timeout 600
kubectl rollout status deploy/api -n production

# Verify cosign signature before deploy
cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com IMAGE@DIGEST

# Export pipeline metrics (Pushgateway)
echo "ci_build_duration_seconds{repo=\"org/api\"} 245" | curl --data-binary @- http://pushgateway:9091/metrics/job/ci

Workflow snippet #7

# Emergency prod rollback (GitOps)
git revert HEAD --no-edit && git push
argocd app sync api-prod --prune --timeout 600
kubectl rollout status deploy/api -n production

# Verify cosign signature before deploy
cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com IMAGE@DIGEST

# Export pipeline metrics (Pushgateway)
echo "ci_build_duration_seconds{repo=\"org/api\"} 245" | curl --data-binary @- http://pushgateway:9091/metrics/job/ci

Workflow snippet #8

# Emergency prod rollback (GitOps)
git revert HEAD --no-edit && git push
argocd app sync api-prod --prune --timeout 600
kubectl rollout status deploy/api -n production

# Verify cosign signature before deploy
cosign verify --certificate-oidc-issuer https://token.actions.githubusercontent.com IMAGE@DIGEST

# Export pipeline metrics (Pushgateway)
echo "ci_build_duration_seconds{repo=\"org/api\"} 245" | curl --data-binary @- http://pushgateway:9091/metrics/job/ci

Tooling matrix

Tool	CLI	Primary use
GitHub CLI	`gh`	pr, run, workflow, secret
GitLab CLI	`glab`	ci, mr, release
Cosign	`cosign`	sign, verify, attest
Trivy	`trivy`	fs, image, config, sbom
Semgrep	`semgrep`	scan, ci, test
Syft	`syft`	packages, attest
Grype	`grype`	sbom:, dir:
Gitleaks	`gitleaks`	detect, protect
Checkov	`checkov`	-d terraform/
Conftest	`conftest`	test -p policy/
Kyverno	`kyverno`	apply, test
OPA	`opa`	eval, test, run
Helm	`helm`	upgrade, rollback, diff
Kustomize	`kubectl kustomize`	build overlays/
ArgoCD	`argocd`	app sync, diff, rollback
Terraform	`terraform`	plan, apply, import
Crane	`crane`	copy, digest, ls
Stern	`stern`	multi-pod logs
Kubectx	`kubectx`	switch context fast
Vault	`vault`	kv, login, policy

Dockerfile hardening checklist (1)

Rule	Dockerfile	Scanner
Non-root USER	`USER 10001`	Dockle, Trivy config
No secrets in ENV	Use runtime injection	Gitleaks, Trivy secret
Pinned base digest	`FROM node@sha256:...`	Renovate bot
Minimal base	distroless or alpine	Image size + CVE count
Multi-stage build	Separate build and runtime	Smaller attack surface

Dockerfile hardening checklist (2)

Rule	Dockerfile	Scanner
Non-root USER	`USER 10001`	Dockle, Trivy config
No secrets in ENV	Use runtime injection	Gitleaks, Trivy secret
Pinned base digest	`FROM node@sha256:...`	Renovate bot
Minimal base	distroless or alpine	Image size + CVE count
Multi-stage build	Separate build and runtime	Smaller attack surface

Dockerfile hardening checklist (3)

Rule	Dockerfile	Scanner
Non-root USER	`USER 10001`	Dockle, Trivy config
No secrets in ENV	Use runtime injection	Gitleaks, Trivy secret
Pinned base digest	`FROM node@sha256:...`	Renovate bot
Minimal base	distroless or alpine	Image size + CVE count
Multi-stage build	Separate build and runtime	Smaller attack surface

Dockerfile hardening checklist (4)

Rule	Dockerfile	Scanner
Non-root USER	`USER 10001`	Dockle, Trivy config
No secrets in ENV	Use runtime injection	Gitleaks, Trivy secret
Pinned base digest	`FROM node@sha256:...`	Renovate bot
Minimal base	distroless or alpine	Image size + CVE count
Multi-stage build	Separate build and runtime	Smaller attack surface

Dockerfile hardening checklist (5)

Rule	Dockerfile	Scanner
Non-root USER	`USER 10001`	Dockle, Trivy config
No secrets in ENV	Use runtime injection	Gitleaks, Trivy secret
Pinned base digest	`FROM node@sha256:...`	Renovate bot
Minimal base	distroless or alpine	Image size + CVE count
Multi-stage build	Separate build and runtime	Smaller attack surface

Dockerfile hardening checklist (6)

Rule	Dockerfile	Scanner
Non-root USER	`USER 10001`	Dockle, Trivy config
No secrets in ENV	Use runtime injection	Gitleaks, Trivy secret
Pinned base digest	`FROM node@sha256:...`	Renovate bot
Minimal base	distroless or alpine	Image size + CVE count
Multi-stage build	Separate build and runtime	Smaller attack surface