Civic Code Lab - Foundations Guide (v0.2 - 2024)

Note for newcomers

Please consult with your manager to create a personalised learning path based on:

• Your current role requirements
• Professional development goals
• Prior experience level

Note: Timeline estimates assume 5-10 hours of study per week alongside regular work duties. Progress may vary based on prior experience and available study time.

Getting Started

Useful Tools

Development Environment

• Github Documentation

Kubernetes (CNCF) Tools

• Skaffold Documentation
• Minikube Tutorial
• Talos Linux Guide

Infrastructure as Code

• AWS IaC Tutorial
• Azure IaC Tutorial

Free Training Resources

These are our recommended resources for building core technical skillsets.

1. Cloud Native Fundamentals (4-6 weeks)

👉 New Team Members Start Here!

• Linux Foundation Cloud Intro
  • Expected outcomes: Understanding of cloud native architecture and principles
• Linux Foundation Kubernetes Intro
  • Expected outcomes: Understanding of container orchestration and basic DevOps practices

2. Cloud Platform Essentials (2-3 weeks)

AWS Resources

• AWS Cloud Practitioner
• AWS Security Fundamentals

Azure Resources

• Azure Fundamentals
• Microsoft Security

3. Development Paths

Understanding the OWASP Projects focused on Secure Development Life Cycle's (SDLC) will help in getting across the common security capabilities platforms and software should generally have. The below Data Integration and Frontend Frameworks all are typically secure by default, however the way they are deployed can significantly change their risk profile. For production or high risk environments it's always best to review the operational procedures against the 2 above standards.

Backend Development (4-6 weeks)

Expected outcomes: Basic programming skills, understanding of software design principles and secure development practices

• Python Guide
• JavaScript Guide
• Software and code security
  • Safestack intro to SDLC
  • OWASP ASVS for software executing on servers (such as Websites and API's) - default to ASVS Level 2
  • OWASP MASVS for software executing on clients (such as Mobile Applications) - default to MAS-L2
  • Testing & QA - Scan for vulnerabilities and configuration/secret issues with Trivy
  • Testing & QA - Playwright browser testing automation framework

Data Integration (2-3 weeks each)

Expected outcomes: Understanding how to ingest/manage data with Python and SQL and generate reports with Markdown

• Build SQL & Data Pipelines with SQLMesh
  • Build Data Pipelines with R targets (for data scientists familiar with R)
• Build static sites & reports with Quarto

Frontend Frameworks (1-2 weeks each)

The below frameworks are all focused on having simple, minimal code easy for small teams to maintain.

• Evidence Web Reports - Web based reporting stack ties nicely in with sqlmesh flows all built on DuckDB
• Capacitor UI Abstraction - Capacitor has excellent web/PWA/iOS/Android targeting support, focusing on Ionic Framework likely easiest for a newcomer due to availability of docs etc.
• Streamlit browser python prototypes can be used for fast prototypes in python that compiles to browser
• Zola is a fast simple static site generator, Astro adds lots more js/app functions but is more complex

Paid Certifications (2-3 months)

• Linux Foundation CNCF Bundle
• AWS Solutions Architect
• Azure Developer Associate