Module 3 · Recall check

1. Your deploy step uses `--set image.tag=${{ github.sha }}`. A colleague suggests switching to `--set image.tag=latest`. What's the concrete risk?

2. A GitHub Actions step uses `${{ secrets.GITHUB_TOKEN }}` to push to GHCR. Where does this token come from?

3. Your pipeline has a separate `test` job and `deploy` job. You want `deploy` to run only if `test` passed. What's the right syntax?

4. A step runs `kubectl port-forward svc/hello 9898:9898 &` then immediately runs `curl http://localhost:9898/healthz`. The curl sometimes fails with connection refused. What's the most likely cause?

5. Your `docker/build-push-action` step sets `push: true`. On a pull request from a fork, the workflow fails at that step. Why?