Follow a Deployment
One commit, followed from a developer workstation to serving traffic. At every hop: what the artifact is right now, which identity is acting, what network path it crosses, how it fails — and how you get back.
Hop 1
Git push
A developer pushes a commit to a branch. Nothing is built and nothing is deployed yet — but the identity that can push is already part of your security model.
Artifact
A commit SHA.
Identity
The developer, authenticated to the source host.
Network path
Developer workstation → source host over TLS.
What can fail here
- A force-push rewrites history the pipeline already built from.
- A compromised developer account is a supply-chain entry point — this is where the chain of custody begins.
Rollback
Revert the commit. Nothing has been deployed, so there is nothing else to undo.
Lessons behind this hop
1 / 10