CI/CD
Browse all articles, tutorials, and guides about CI/CD
Posts
You Cannot Rotate a Secret You Cannot Find
Trace one credential from a laptop to production and count the copies it leaves behind. That count is your rotation cost and your blast radius, and it is why most teams never rotate anything.
What Does One Merge Actually Cost You in CI?
Wall-clock time and machine minutes are different numbers, and most teams track only one. Here is how to get both from your own repo.
Stacked Pull Requests on GitHub: What They Actually Fix
GitHub shipped stacked pull requests to public preview. What stacking solves, how the gh-stack workflow works, and when a stack is the wrong shape.
Explaining CI Failures Automatically with a GitHub Action
We built a GitHub Action that reads a failing job log and tells you what broke, using DigitalOcean serverless inference. The interesting part was not the model call. It was throwing away 92% of the log before sending it.
One git push to RCE: the anatomy of CVE-2026-3854 and the parsing bug behind it
A single git push could execute code on GitHub's backend, with cross-tenant reach on github.com itself. The root cause is a bug you almost certainly have somewhere too: untrusted input smuggled through a delimited internal header.
The pwn request just got harder: what actions/checkout v7 changes, and what it does not
GitHub is backporting a fork-checkout block to actions/checkout, with enforcement on July 20, 2026. Here is what a pwn request actually is, what the change stops, and the three ways your pipeline is still exposed after you upgrade.
Your GitOps Controller Is Tier Zero: the Argo CD repo-server RCE
An unauthenticated RCE in Argo CD's repo-server turns one compromised pod into full cluster takeover. Reported 18 months ago, still unpatched. Here is how it works and the one control that stops it.