Stop installing the same tools on every pipeline job
Nearly every CI job began by fetching and compiling the same tools. Baking them into one image instead, and what that saved per pipeline.
Tags
25 pages
CI/CD
The build gate these sites never had
Three Hugo sites each hand-rolled a near-identical deploy job that only ever ran on merge, so nothing ever checked the build before it landed.
The secret that wasn't on my branch
A secret scanner failed a merge request over a test key and a documentation PEM that the change did not contain. Scoping a scan properly.
Sign your own binaries with go-tool-base, part 6: sign every release with GoReleaser
Make a tagged release sign itself: record the KMS key and regenerate GoReleaser config with a signs block that calls gtb sign directly.
Three traps release-plz sets for a Rust workspace
Three traps release-plz sets for a Rust workspace, starting with a default tag template that collides the moment you have more than one crate.
Same config, two answers
Publishing a seventeen-crate Rust workspace to crates.io, and why the same release configuration produced two different answers.
From allow_failure to blocking
Turning three advisory CI jobs into real gates once they were trustworthy enough to block a merge, and how to tell when they are.
Two bugs that taught me the rules
Two CI and infrastructure bugs with one shape: a GitLab job with no rules block skips merge requests, and an import block runs only once.
Reviewed, then applied
Closing the plan-versus-apply gap in infrastructure CI by applying the saved plan artifact rather than quietly re-planning at apply time.
CI you include, not copy
Copied .gitlab-ci.yml files drift out of sync. How GitLab CI/CD Components let a repo include and version-pin a shared pipeline instead.
