Production Capstone: Govern a GitHub Organization and Build a Secure End-to-End Delivery System: Final Operational Review and Handoff

1. Final mission and preflight

The final checkpoint is not “create the repository again.” It is an operator handoff: another engineer should be able to understand the architecture, identify the allowed change/release paths, reproduce verification, respond to the four mandatory failure classes, and know what must be cleaned up.

• Required local tools: Git, GitHub CLI, Python 3, Node.js/npm, sha256sum, and GNU tar/gzip for the demonstrated deterministic archive.
• GitHub account: GitHub.com personal account able to create a disposable public repository and use Actions/security features available to public repositories.
• Safety: no real credential, production repository, employer organization, self-hosted runner, cloud account, or private package is needed.
• Optional organization extension: use only an organization you own for training; do not invite real coworkers merely to satisfy the lab.
• Before destructive cleanup: export final evidence first. Repository deletion, tag force-update, history rewrite, package deletion, token creation, and policy bypass are not required.

2. Handoff architecture and threat model

flowchart TD
REQ[Issue / requirement] --> PR[PR + review]
PR --> GATE[Ruleset + verify]
GATE --> MAIN[main SHA]
MAIN --> REL[Manual release-evidence]
REL --> BYTES[artifact + SHA-256]
REL --> PROV[attestation / OIDC identity]
BYTES --> RELEASE[GitHub Release]
PROV --> VERIFY[consumer verification]
RELEASE --> VERIFY
SEC[Dependabot / CodeQL / secret protection] --> PR
API[Read-only API evidence] --> EVID[Evidence packet]
PR --> EVID
GATE --> EVID
REL --> EVID
VERIFY --> EVID
OPS[Runbooks / owners / exceptions] --> EVID

Threats considered include malicious/unreviewed source, workflow privilege escalation, compromised dependency, leaked credential, bypass abuse, runner/network compromise, artifact substitution, stale access after offboarding, incomplete API inventory, and cost pressure that encourages bypass. No single GitHub feature eliminates these threats; the model uses layered prevention, detection, verification, and recovery.

3. Required handoff inventory

4. Run at least four controlled failures

Optionally add the runner-authority and credential-response fixtures from Lesson 4. Record actual detection/containment/recovery timestamps and residual risk for each drill.

5. Prove critical invariants independently

A production handoff should not say “the pipeline was green.” Prove at least these five invariants from different evidence surfaces:

# Invariant 1 — release tag resolves to the exact source commit.
TAG="v0.1.0-capstone"
RELEASE_SHA="$(gh api -H "X-GitHub-Api-Version: 2026-03-10"   "repos/$FULL/git/ref/tags/$TAG" --jq .object.sha)"
printf 'tag_sha=%s\n' "$RELEASE_SHA"

# Invariant 2 — the expected ruleset is active and has no unintended bypass actor.
gh api -H "X-GitHub-Api-Version: 2026-03-10"   "repos/$FULL/rulesets"   --jq '.[] | select(.name=="capstone-main") | {id,name,enforcement,bypass_actors,rules}'

# Invariant 3 — workflow at release SHA is deny-by-default with job-local authority.
gh api -H "X-GitHub-Api-Version: 2026-03-10"   -H 'Accept: application/vnd.github.raw+json'   "repos/$FULL/contents/.github/workflows/capstone.yml?ref=$RELEASE_SHA"

# Invariant 4 — artifact bytes match recorded digest and trusted attestation policy.
cd release-download
sha256sum -c capstone.tar.gz.sha256
gh attestation verify capstone.tar.gz   --repo "$FULL"   --signer-workflow "$FULL/.github/workflows/capstone.yml"   --source-ref refs/heads/main   --deny-self-hosted-runners   --format json
cd ..

# Invariant 5 — the release record exposes the expected tag/assets.
gh release view "$TAG" -R "$FULL" --json tagName,targetCommitish,url,assets

# Invariant 6 — no repository-scoped Actions secret was created for this lab.
# This does NOT prove absence of org/environment/Dependabot/Codespaces secrets.
gh secret list -R "$FULL"

The sixth check is intentionally scoped: an empty repository secret list is not a universal “no secrets exist” proof. Evidence must describe what it can and cannot establish.

6. Assemble the final evidence packet

mkdir -p handoff/final
printf '%s\n' "$RELEASE_SHA" > handoff/final/release-source-sha.txt
sha256sum release-download/capstone.tar.gz > handoff/final/release-artifact.sha256

gh repo view "$FULL" --json nameWithOwner,visibility,defaultBranchRef,url   > handoff/final/repository.json
gh api -H "X-GitHub-Api-Version: 2026-03-10" "repos/$FULL/rulesets"   > handoff/final/rulesets.json
gh pr list -R "$FULL" --state all --limit 100   --json number,title,state,headRefOid,mergeCommit,url   > handoff/final/pull-requests.json
gh run list -R "$FULL" --limit 100   --json databaseId,workflowName,event,headSha,status,conclusion,createdAt   > handoff/final/workflow-runs.json
gh release view "$TAG" -R "$FULL" --json tagName,targetCommitish,url,assets   > handoff/final/release.json
gh attestation verify release-download/capstone.tar.gz   --repo "$FULL"   --signer-workflow "$FULL/.github/workflows/capstone.yml"   --source-ref refs/heads/main   --deny-self-hosted-runners   --format json > handoff/final/attestation.json

python - <<'PY'
from pathlib import Path
import hashlib, json, datetime
root=Path('handoff/final')
rows=[]
for f in sorted(root.glob('*')):
    if f.is_file():
        rows.append({'file':f.name,'bytes':f.stat().st_size,'sha256':hashlib.sha256(f.read_bytes()).hexdigest()})
out={'captured_at_utc':datetime.datetime.now(datetime.timezone.utc).isoformat(), 'files':rows}
Path('handoff/final-manifest.json').write_text(json.dumps(out,indent=2)+'\n')
PY
cat handoff/final-manifest.json

For an eligible organization, add a narrowly time-bounded audit-log export/API query and store it outside the account under investigation according to retention policy. In this personal free lab, the packet remains honest about the absence of enterprise audit evidence.

7. Final incident runbook index

8. Cleanup and rollback

The mandatory exercise did not create a PAT, App key, cloud credential, self-hosted runner, or private package, so there is no hidden credential cleanup step. Finish with evidence export, local cleanup, and repository disposition.

# Close only synthetic open issues you created for the automation drill.
gh issue list -R "$FULL" --state open --limit 100 --json number,title   --jq '.[] | select(.title | startswith("automation-fixture-")) | .number'   | while read -r n; do gh issue close "$n" -R "$FULL" --comment "Disposable capstone cleanup"; done

# Verify no repository-scoped Actions secrets were created by this lab.
gh secret list -R "$FULL"

# Preserve the local handoff outside the repository if desired, then remove temp files.
rm -f /tmp/capstone-tampered.tar.gz /tmp/access-fixture.json

# Safe default: archive the disposable hosted repository instead of deleting it immediately.
gh repo archive "$FULL" --yes

gh repo view "$FULL" --json nameWithOwner,isArchived,visibility,url

9. Operator handoff checklist

• Architecture diagram names every trust boundary and optional external system.
• Repository ownership, team/role model, review rule, ruleset target, required check name, and emergency authority are documented.
• Workflow triggers, runner class, action pins, job permissions, OIDC usage, concurrency, and retention are documented.
• Release policy names source SHA, tag/version semantics, artifact digest, attestation policy, and rollback identity.
• Security findings have owners, severity/remediation rules, dismissal authority, and exception expiry.
• Credential incident runbook starts with revoke/rotate and covers non-Git exposure surfaces.
• At least four failure-drill records contain times, evidence, correction, verification, residual risk, and preventive owner.
• Evidence packet is hashed and stored according to retention/chain-of-custody needs.
• Cost/performance review has metrics and a responsible owner; optimization cannot remove the stable required gate invisibly.
• Cleanup confirms no lab credential exists and records archive/deletion disposition.

10. Operational maturity review and course bridge

Completing this capstone does not replace deeper specialist study. The dedicated GitHub Actions, GitLab, CI/CD, artifact management, DevSecOps, cloud, Kubernetes, and GitOps courses go further into their own execution models and operational depth. What this GitHub course adds is the platform-level mental model needed to connect those systems safely.

Capstone review questions

Final summary

The GitHub course closes with an operating system, not a checklist of features: requirements precede controls; identities have bounded authority; source change, execution, release, provenance, and evidence are separate planes; public/free capabilities provide a complete learning path; enterprise controls are labeled rather than fabricated; and recovery is tested under interacting failures. The final handoff gives the next operator enough evidence to secure, audit, recover, and evolve the platform.

Official references

• GitHub Docs — GITHUB_TOKEN
• GitHub Docs — OIDC
• GitHub Docs — Code scanning
• GitHub Docs — Secret scanning
• GitHub Docs — Artifact attestations
• GitHub Docs — REST API