Title: Quiz 14 — CI/CD for ML with GitHub Actions
Course: AIINFRA 101: Applied Infrastructure & Containerization > Section: Week 14 — CI/CD for ML with GitHub Actions

Q: Which term describes a pipeline where every change that passes automated tests is packaged into a release that is always ready to go out, but still requires a human to click "approve" before it reaches production?
- Continuous Integration
- Continuous Delivery
- Continuous Deployment
- Continuous Testing
A: Continuous Delivery

Q: What is the exact folder path, relative to the repository root, where GitHub Actions workflow files must be placed for GitHub to recognize and run them?
Feedback: Sample/expected answer: `.github/workflows/` (workflows, plural)

Q: Which of the following is a real limitation of GitHub's automatic secret masking in logs?
- Secrets longer than 64 characters are never masked
- Base64-encoded copies of a secret bypass masking
- Masking only works on private repositories
- Masking applies only to the first workflow run after a secret is created
A: Base64-encoded copies of a secret bypass masking

Q: Evaluating a model's accuracy only on the data it was trained on gives a reliable picture of how it will perform on new, unseen data.
- True
- False
A: False

Q: In one or two sentences, explain the key difference between what pytest typically tests and what Great Expectations typically tests in an ML pipeline.
Feedback: Sample/expected answer: Pytest tests the logic/behavior of your code (functions, classes, endpoints), while Great Expectations tests the quality and structure of your data (schema, ranges, nulls, categories) — both can run as automated gates in CI, but they check different things.

Q: Why is tagging a Docker image only with :latest considered a CI/CD anti-pattern?
- `:latest` images are always larger in file size
- `:latest` is a mutable tag that can be repointed to a different image, making deployments non-reproducible
- Docker registries do not allow pulling `:latest` images in production
- `:latest` tags cannot be scanned for vulnerabilities
A: `:latest` is a mutable tag that can be repointed to a different image, making deployments non-reproducible

Q: What Dockerfile reordering avoids busting the dependency-cache layer on every code change, and why does it work?
Feedback: Sample/expected answer: Copy and install `requirements.txt` (or equivalent dependency manifest) before copying the rest of the application code; Docker caches each layer, so if the dependency file hasn't changed, the install layer is reused instead of rerun, even when application code changes.

Q: A "model quality gate" step in an ML CI workflow, as built in Lab 14, should do which of the following?
- Always pass, since model performance is evaluated manually later
- Load the trained model, evaluate it on held-out data, and fail the build if accuracy drops below a set threshold
- Only check that the model file exists on disk
- Replace the need for any data validation tests
A: Load the trained model, evaluate it on held-out data, and fail the build if accuracy drops below a set threshold