Rotating a signing key without breaking self-update
Signing releases is the easy day. Replacing the key you sign with, while every installed copy is still checking against the old one, is a job I went looking for a guide to and couldn't find.
Tags
9 pages
Release
The release that OOM-killed its own compiler
A wedding-photo culler ran out of memory compiling an LLM SDK it has never once called. The release had been running for thirty-eight minutes at that point.
The bill for fifty-one modules
Change one line in the tls module and you've signed up for twelve releases. That's not a bug in the architecture, that's the architecture.
Nine tags that were never on the branch
colophon works out the version your commits have earned, opens the release as a merge request, and tags what actually landed. Not what your forge says did.
Your first run with skillup
A change that ships without a version bump reaches nobody, and nothing tells you. Ten minutes in a throwaway directory to see it happen, and then catch it.
The CVE that bumped my dependency for me
Three HIGH advisories deep in a Rust dependency tree, a one-line fix that changed nothing, and eleven minor bumps that were never mine to make.
The version pin you can't lower
A standard-library security fix forced a Go version bump, and then the release failed because the build image shipped an older toolchain.
A release is just another merge request
Moving off tag-on-merge releases, where a release is a side effect of merging, to a model where the release is itself a reviewable change.
The component that fired on every schedule
A CI component gated on the default branch fired on every Renovate schedule too, because a scheduled run is also on the default branch.
