One image for the whole toolchain
Baking OpenTofu, tflint and trivy into a single version-pinned CI image, and publishing the scanned tarball with crane to avoid a kaniko rebuild.
Categories
103 pages
Pioneering
Notes from active builds: the design decisions, war stories and how-it-works of whatever I'm making right now.
A 403 you can't fix in IAM
A GitLab to AWS OIDC trust policy kept returning 403, and no IAM change fixed it: the policy matched a claim GitLab never actually asserts.
Pure-Rust Git, no git binary
Doing local Git from Rust with gix rather than shelling out to the git binary or linking libgit2, and why that avoids a lot of cross-compilation pain.
Routing security findings without the noise
Routing AWS GuardDuty and Security Hub findings so an alert still means something: forward high severity only, and drop the duplicates.
Why go-tool-base left GitHub for GitLab
An accidental major version bump was the last straw after months of unreliability. Why a Go framework moved off GitHub, and what moved with it.
Why I hand-rolled every module
Why security-critical infrastructure got raw resources rather than community wrapper modules, and what that actually cost in lines and in review.
Hardening the account that will hold the keys
Applying a security baseline to a fresh AWS account: audit logging, config recording, threat detection and an operator role that is not root.
No access keys in CI
Replacing long-lived AWS access keys in CI with OIDC federation, so the pipeline mints a short-lived token instead of holding a secret.
Two layers of tags, and which one wins
AWS tagging in two layers: account-wide invariants on the provider default tags, resource specifics in the module, and which one wins on a clash.
clap's global flag, except in a passthrough subtree
Why a clap global flag stops working inside a passthrough subtree: the tokens get captured as trailing args before the flag is ever parsed.
