ci-cd – Page 12 – Türker Yıldırım

A build secret is mounted for one RUN and lands in no layer

NoteMarch 3, 20222 min read

A build argument is recorded in the image history whether or not it was used, so a token passed as ARG is readable by anybody who can pull…

Laravel 9 moved to Symfony 6 and took PHP 8 with it

Deep diveFebruary 17, 20229 min read

February, the first annual major, and a version number that means less than it used to. The work is two packages that block everything.

Testing a block theme without a browser

Deep diveFebruary 16, 202210 min read

A theme with no PHP has nothing a unit test can call, and the only test is a person looking at a page.

A theme.json schema check in CI

NoteFebruary 10, 20221 min read

A typo in a theme.json key is silently ignored, which means a setting that does nothing looks exactly like a setting that works. The published schema is versioned…

A dependency inventory generated in the pipeline

NoteDecember 28, 20212 min read

An inventory maintained by hand is out of date the day it is written; one generated by the build is correct by construction. Three sources are needed because…

A deploy that can be undone in ninety seconds

Deep diveDecember 23, 202110 min read

The rollback plan was “redeploy the previous tag” and it took nineteen minutes. Rolling back is a build, and a build is not fast.

A randomised test order, in CI, on every push

NoteDecember 20, 20211 min read

Tests that pass in file order and fail in any other order are testing the order, and the coupling is invisible until something is added. The seed being…

A dependency inventory you can answer questions from

Deep diveDecember 11, 202114 min read

9 December, a Java vulnerability, and a stack with no Java in it. “Are we affected” took eleven hours to answer with confidence.

OIDC to the cloud, so the pipeline holds no long-lived key

Deep diveNovember 30, 202110 min read

A deploy key valid since 2018, in a settings page, with no expiry and no audit trail. A token exchange replaces it, if the trust is scoped narrowly.

Static analysis at level 8, and the six months it took

Deep diveNovember 26, 202115 min read

1.0 in November after five years of 0.x. Level 0 passes and finds nothing anybody cared about; raising the level all at once does not work.