Professional Lab
Reviewing a Configuration Change for Risk
Objective
Produce a real Git diff between trunk and a proposed branch, then scan the diff itself for critical operational lines being removed -- a risk check, not just a display of the diff.
Builds on Git / NetDevOps.
Prerequisites
- Comfortable with GitPython commits and repo.git.diff() (GitPython: Driving Git from Python)
- Comfortable with branches and the review-before-merge workflow (Branches and Diffs: Reviewing a Change Before It Ships)
Scenario
The problem
Branches and Diffs taught you to generate a real diff and read it before merging. This lab asks what a reviewer actually does with that diff: skim it for one specific danger -- a line quietly being removed that shouldn't be. A change that adds a new ACL rule looks fine at a glance. If it also deletes service password-encryption on the way, that's the part a fast read misses and an automated first-pass check shouldn't.
Review only -- not the Capstone's rollout
This lab stops at producing a diff and a risk verdict. It doesn't merge the branch, generate a remediation, or stage any rollout -- that chain belongs to the Capstone. This is the review step, done well, on its own.
Task
Write init_repo(repo_path) that initializes a real local Git repo with a placeholder author identity (from environment variables, never hardcoded — the same pattern every Git-touching lesson in this curriculum uses).
Write commit_baseline(repo) that writes a config file to the repo containing (at minimum) service password-encryption and logging host 10.10.10.50, then commits it to trunk.
Write propose_change(repo, branch_name) that creates and checks out a new branch, rewrites the config file to remove service password-encryption while adding a new ACL block, and commits that change on the branch.
Write get_review_diff(repo, branch_name) that returns repo.git.diff(f"{trunk}...{branch_name}").
Write assess_risk(diff) that finds every removed line (starts with "-", but not the "---" file-header line) and flags the diff as risky if any removed line contains one of: "service password-encryption", "logging host", "ntp server", "aaa authentication".
Expected output
--- Review diff ---
diff --git a/sw1.cfg b/sw1.cfg
index 59dddca..6c69582 100644
--- a/sw1.cfg
+++ b/sw1.cfg
@@ -1,5 +1,6 @@
hostname SW1
-service password-encryption
logging host 10.10.10.50
interface GigabitEthernet0/1
description mgmt-uplink
+ip access-list extended GUEST-ACL
+ permit tcp any any eq 443
--- Risk assessment ---
{'removed_lines': ['service password-encryption'], 'flagged': ['service password-encryption'], 'risky': True}Real, verified output from an actual local Git repository this lab's script creates. The new ACL addition is real and legitimate-looking -- the risk check still correctly catches the one line that matters.
Self-check only -- nothing here is submitted or graded. Compare against your own output manually.
Solution
Try the task yourself first -- the full solution and explanation stay hidden until you click above.
Key takeaways
- A reviewer's first useful automated check isn't 'show me the diff' -- it's 'does this diff remove something it shouldn't,' which requires actually inspecting the diff's content.
- A change can look legitimate (a new ACL, a reasonable commit message) while still containing a real regression -- the two aren't mutually exclusive.
- This lab stops at review and risk assessment -- no merge, no remediation, no rollout. That's the Capstone's job, not this lab's.
- A real local Git repository was used throughout -- no real remote, GitHub, or GitLab was contacted or required.
Related lessons
Done with this lesson?