CI/CD · OIDC · Advanced
OIDC presents the wrong audience
A CI job cannot exchange its OIDC token for cloud credentials.
INITIAL ALERT
A CI job cannot exchange its OIDC token for cloud credentials.
You are primary on-call. Establish the failure domain, protect healthy capacity, and choose the safest next action.
The role trust policy names the correct repository and branch.
The decisive evidence and solution remain locked inside the simulation.WHAT THIS TESTS
Production judgment across CI/CD · OIDC.
A green pipeline can still ship the wrong artifact or an unrecoverable change. Reliable delivery depends on provenance, identity, reconciliation ownership, and rollback compatibility.
- 01Verify build and artifact provenance
- 02Diagnose deployment identity failures
- 03Plan rollback around irreversible changes
SIMULATION STRUCTURE
Four evidence layers. No answer shown here.
The full exercise unlocks each layer as you commit to decisions.
Alert
Confirm the reported symptom and customer impact.
Baseline
Compare the failing path with a known-good condition.
Finding
Identify the evidence that separates plausible causes.
Change
Choose a controlled recovery and a durable prevention step.
Can you make the call without seeing the solution?
Try three incidents free. Paid incidents unlock only after Stripe confirms lifetime access.