Skip to main content

CI/CD

Browse all articles, tutorials, and guides about CI/CD

9posts

Guides

Security Gates

Implement automated security gates that block deployments on critical vulnerabilities, policy violations, and security failures. Shift security left in your CI/CD pipeline.

Posts

CI/CD
|15 min read

The 9 Types of API Testing, and Where Each Belongs in Your Pipeline

Telling load testing from stress testing is easy. What shapes delivery is which of the nine run on every pull request, and which only run after a deploy.

Security
|16 min read

You Cannot Rotate a Secret You Cannot Find

Trace one credential from a laptop to production and count the copies it leaves behind. That count is your rotation cost and your blast radius, and it is why most teams never rotate anything.

CI/CD
|13 min read

What Does One Merge Actually Cost You in CI?

Wall-clock time and machine minutes are different numbers, and most teams track only one. Here is how to get both from your own repo.

Git
|11 min read

Stacked Pull Requests on GitHub: What They Actually Fix

GitHub shipped stacked pull requests to public preview. What stacking solves, how the gh-stack workflow works, and when a stack is the wrong shape.

CI/CD
|11 min read

Explaining CI Failures Automatically with a GitHub Action

We built a GitHub Action that reads a failing job log and tells you what broke, using DigitalOcean serverless inference. The interesting part was not the model call. It was throwing away 92% of the log before sending it.

CI/CD
|11 min read

One git push to RCE: the anatomy of CVE-2026-3854 and the parsing bug behind it

A single git push could execute code on GitHub's backend, with cross-tenant reach on github.com itself. The root cause is a bug you almost certainly have somewhere too: untrusted input smuggled through a delimited internal header.

CI/CD
|11 min read

The pwn request just got harder: what actions/checkout v7 changes, and what it does not

GitHub is backporting a fork-checkout block to actions/checkout, with enforcement on July 20, 2026. Here is what a pwn request actually is, what the change stops, and the three ways your pipeline is still exposed after you upgrade.

Security
|11 min read

Your GitOps Controller Is Tier Zero: the Argo CD repo-server RCE

An unauthenticated RCE in Argo CD's repo-server turns one compromised pod into full cluster takeover. Reported 18 months ago, still unpatched. Here is how it works and the one control that stops it.