Blog
Closing the plan-versus-apply gap in infrastructure CI by applying the saved plan artifact rather than quietly re-planning at apply time.
Why an infrastructure repo stays one OpenTofu graph rather than splitting into per-concern stacks: the engine enforces ordering for free.
Copied .gitlab-ci.yml files drift out of sync. How GitLab CI/CD Components let a repo include and version-pin a shared pipeline instead.
Baking OpenTofu, tflint and trivy into a single version-pinned CI image, and publishing the scanned tarball with crane to avoid a kaniko rebuild.
A GitLab to AWS OIDC trust policy kept returning 403, and no IAM change fixed it: the policy matched a claim GitLab never actually asserts.
Doing local Git from Rust with gix rather than shelling out to the git binary or linking libgit2, and why that avoids a lot of cross-compilation pain.
Routing AWS GuardDuty and Security Hub findings so an alert still means something: forward high severity only, and drop the duplicates.
An accidental major version bump was the last straw after months of unreliability. Why a Go framework moved off GitHub, and what moved with it.
Why security-critical infrastructure got raw resources rather than community wrapper modules, and what that actually cost in lines and in review.
Applying a security baseline to a fresh AWS account: audit logging, config recording, threat detection and an operator role that is not root.
cicd
infrastructure
Pioneering
rust-tool-base
go-tool-base
