2.4 in August adds an audit command that checks the lock file against the Packagist advisory database, which several separate tools had been doing. Reading the lock file…
The build context is everything not excluded, so a missing .dockerignore uploads the git history, the node modules and the local database to the daemon before anything is…
Path filters answer whether a workflow runs; deciding which packages a change affects needs the dependency graph as well as the diff. The transitive closure is what makes…
An architecture diagram describes an intention and a dependency check describes what is true, and the two diverge from the first week. –report-uncovered is the flag worth turning…
A CI runner is shared, throttled and occasionally slow, so any assertion about wall-clock time fails eventually for reasons unrelated to the code. Query counts and memory are…
A pipeline that reports its result by making somebody open the log is a pipeline whose result nobody reads. Writing the failure explanation into the summary rather than…