A rate limiter is four lines of Redis and a decision between two algorithms that behave differently at the boundary, and most hand-rolled ones pick the worse of…
uses: some/action@v2 resolves a tag, and a tag is a mutable pointer — so the code running in your pipeline can change without anything in your repository changing.…
Passing a private repository token as a build argument writes it into the image history, where docker history reads it back out for anyone who can pull the…
A secret in an environment variable is visible in docker inspect, in the process environment and in any crash dump that prints the environment. The _FILE convention is…
React attached all its listeners to document, which is why two React versions on one page could not coexist and why mixing React with anything else was fragile.…
Timing a function in a loop measures the loop, the opcache state, the CPU frequency scaling and occasionally the garbage collector — and rarely the function. The empty-loop…
The three status fields people read all measure something slightly different from what the question was, and knowing which is which is the difference between a useful alert…
A workflow triggered by pull_request from a fork has no secrets, deliberately. pull_request_target runs in the context of the base repository and does have them. Combining pull_request_target with…
Documentation written by hand is a copy of the implementation, and copies drift — usually within a sprint, and always without anybody noticing. The annotations are verbose and…