The Copilot StackTechnical Academy

Learning path

DevOps engineer learning path

Infrastructure work changes the risk calculation: a wrong suggestion may reach production. This path pairs every capability with the boundary that contains it, and spends real time on the CLI's permission model.

For
Engineers whose mistakes get applied to running systems rather than caught by a test suite.
Lessons
18 existing Academy lessons
Reading time
about 4¾ hours
Prerequisites
Working knowledge of at least one of Terraform, Kubernetes or CI/CD.

of 18 complete (%)

  1. Stage 1Ground rules

    Start with what Copilot is and how a plan constrains it, so the later permission decisions have something to stand on.

    • What Is GitHub Copilot and How Does It Work?— completed

      A precise definition of the product, how context shapes its output, what it can and cannot do, and where developer responsibility begins.

    • GitHub Copilot for DevOps Engineers— completed

      The validation model for AI-generated infrastructure: what Copilot genuinely helps with across twelve technologies, and the gates that decide whether any of it is trustworthy.

  2. Stage 2Infrastructure as code

    The plan output is the safeguard. These lessons are about reading it rather than trusting the configuration that produced it.

    • GitHub Copilot for Terraform— completed

      Variables, for_each, modules and state, with fmt, validate and a policy scan as the gate — and why a security fix can add three new findings.

    • GitHub Copilot for OpenTofu— completed

      What actually differs from Terraform: the registry host, the licence, and state encryption — demonstrated end to end with a state file that cannot be read without its passphrase.

    • GitHub Copilot for Ansible— completed

      Idempotent roles, handlers and validated templates — and a linter that found nineteen problems in a draft playbook while ignoring the plaintext password in it.

    • GitHub Copilot for Kubernetes— completed

      Probes, resource limits, securityContext and NetworkPolicy — and a manifest that passed strict schema validation with twenty-one security findings in it.

  3. Stage 3Containers and pipelines

    Where generated configuration most often ships something you did not intend — an oversized image, a floating action reference.

    • GitHub Copilot for Docker— completed

      Multi-stage builds, non-root runtime users and layer caching — plus a measured comparison showing a first-draft Dockerfile producing an image 7× larger than it needed to be.

    • GitHub Copilot for Docker Compose— completed

      Health-gated startup, service dependencies that actually wait, and why a Compose file that parses cleanly can still publish your database to the network.

    • GitHub Copilot for GitHub Actions— completed

      Least-privilege permissions, SHA-pinned actions, OIDC and the script-injection vector in a pull request title — the one thing actionlint does catch.

    • Build an AI-Powered CI/CD Pipeline with GitHub Copilot— completed

      The capstone: one repository where Copilot writes every artefact and validates none of them — application, image, Terraform, manifests and workflow, behind gates that ran for real.

  4. Stage 4The CLI and its permission model

    The most consequential material on this path. Denial beats allow, visibility is not approval, and non-interactive runs have nobody to ask.

    • GitHub Copilot CLI: Complete Guide— completed

      The terminal-native agent in full: what it can read, change and execute, how the permission model actually works, and why approval is the only boundary that holds.

    • How to Install GitHub Copilot CLI— completed

      Five installation routes across three platforms, why the retired gh-copilot extension still appears in search results, and what the install script actually does.

    • GitHub Copilot CLI Commands Cheat Sheet— completed

      Every slash command, flag and subcommand verified against a real installation, grouped by what it can do to your machine rather than by alphabet.

    • GitHub Copilot CLI for DevOps Engineers— completed

      Terraform, Kubernetes, Docker and Ansible from the terminal under least-privilege tool policies that permit validation and refuse apply.

    • Automating GitHub Copilot CLI with GitHub Actions— completed

      The capstone: copilot-requests permissions, GITHUB_TOKEN authentication, narrow tool policies, and why forked pull requests are where automation goes wrong.

  5. Stage 5Agents with tools

    An agent that can reach your infrastructure is a permission question before it is a capability question.

    • Build a DevOps Agent with GitHub Copilot— completed

      An infrastructure agent that validates and never applies — agent profile, skill and instructions combined into one coherent repository-ready example.

    • GitHub Copilot MCP: Complete Guide— completed

      Model Context Protocol as Copilot implements it: clients, servers, tools versus resources, transports, authentication, and the security model that matters most.

    • GitHub Copilot MCP Security: Governing External Tools— completed

      The MCP threat model at enterprise scale: allowlists in managed settings, why the private registry is not the stronger control, and the surface it does not reach.

Put it into practice

Labs

Projects

  • Terraform starter

    An inert configuration anyone can validate without cloud credentials, with a validation block on every ranged variable.

  • Kubernetes starter

    Manifests with Pod Security Admission, three probes that each answer a different question, and a default-deny NetworkPolicy.

  • GitHub Actions starter

    A workflow with least-privilege permissions and every action pinned to a commit SHA, because a tag is mutable and runs with your token.

  • CLI workflows

    Terminal workflows organised around the permission ladder — read, then write, then a named shell command — with a verification step you perform yourself.

Check yourself

Reading time is computed from the prose of the lessons listed above at 200 words per minute, excluding code blocks. It is an estimate of reading, not of the practice that makes any of it stick.