World C2: Container Pipelines

Capstone mission 2: Ship it

You will learn: to give Kedai Kancil a real pipeline that lints, tests, scans and pushes.

Checked with GitHub Actions 2026-10 on 31 Oct 2026

The problem

Mission 2: ship it! Your Kedai Kancil repo from Mission 1 gets its own green line. First, put the stations in order.

First station at the top. Put these in order. Use the arrows, or drag.

Scan for critical CVEs
Build the images
Run the tests
Push to GHCR (main only)
Lint the Dockerfiles

Try it

Build ci.yml: lint and test, then build, scan and push both images. You will copy this file next.

Tap blocks to add them. Put them in order.

Blocks

Your workflow

Tap a block above to start.

Workflow file .github/workflows/

name: Ship it

What runs

Nothing to run yet.

Try it

Now do it for real, step by step. Your ticks are saved.

Real mission

In your kedai-kancil folder, start a new branch.
git switch -c add-green-line
Make the workflow folder.
mkdir -p .github/workflows
Save the YAML you built as .github/workflows/ci.yml. Rename web, api or the compose service if yours differ.
Proofread it before you push.
docker run --rm -v "$PWD:/repo" -w /repo rhysd/actionlint:1.7.12
Save it in Git and push the branch.
git add .github && git commit -m "Add the green line" && git push -u origin add-green-line
Open a pull request. Watch lint, test and image run, with no push.
Merge it. The run on main pushes both images to GHCR.
A red station? Read the red line, fix it, and push again.

0 of 8 steps done · Your ticks are saved.

Check

GitHub can confirm part of it. Type your username and press Check now.

Check it on GitHub

Your kedai-kancil repo is publicNot checked yet
It has .github/workflows/ci.ymlNot checked yet
Workflows ran at least twice: the PR and mainNot checked yet

Check

The rest only you can see. Open your repo and tick what is true.

Self-check

The latest run on main has a green tick.
The PR run built, tested and scanned, but did not push.
Packages shows kedai-kancil-web and kedai-kancil-api.
Each image has a main tag and a sha- tag.
Only the image job has packages: write.

0 of 5 steps done · Your ticks are saved.

You did it!

You can now ship a real app: lint, test, scan, push.

Go deeper (optional)

Where the story breaks. A real belt moves one pack at a time. A pipeline runs many jobs at once. Each worker forgets everything after its job. And a tag is not glued on. It can move to another pack. Only the digest (sha256:…) never changes.

Bahasa Melayu