Cancelling superseded runs is right for tests and wrong for a deploy, and the same key applied to both produces a half-finished release. A deploy cancelled between the…
Three docker build invocations in a shell script share nothing and cannot run in parallel; a bake file describes them as a graph. The inheritance is what makes…
pull_request_target runs in the context of the base repository with access to secrets, and checking out the pull request code under it executes a stranger’s code with those…
A layer cache is invalidated by a lock file change; a cache mount survives it, because the downloaded packages are not in the layer at all. The syntax…
A version number that is a compatibility statement rather than a feature list. Three environments described by hand, and the import that is most of the work.
A cron job that fails writes to whatever mail was configured in 2014, and a timer’s output is in the journal alongside everything else. Persistent=true runs a missed…
Infrastructure code accumulates whitespace disagreements faster than application code, because it is edited rarely and by different people each time. -check makes it a gate rather than a…
Most PHP repositories contain JavaScript for the build, and the moment one of those scripts does something operational it needs an owner. The build script is fine unowned…