Türker Yıldırım

ci-cd

  • The incident that was a certificate, again

    Deep dive10 min read

    The third certificate incident in six years, each with a different cause. An expired certificate on a service nobody remembered was serving TLS.

  • A composite action that grew an input too many

    Note2 min read

    A shared setup action across four repositories, with eleven inputs, of which one repository used a combination nobody had tested. A shared abstraction with per-caller escape hatches is…

  • Composer 2.8, and audit as a merge gate

    Note1 min read

    Running the audit in CI for a year had produced a report; making it fail the merge produced a decision. Failing only on high and critical is what…

  • A test suite that runs on every commit, in ninety seconds

    Deep dive9 min read

    Four minutes forty is fine and ninety seconds changes behaviour. The threshold below which running the suite stops being a decision.

  • Docker Compose in production, and why it is still here

    Deep dive10 min read

    Six years of Compose on a VPS, and an annual conversation about orchestration. Nothing is wrong, which is why the conversation keeps happening.

  • Managing WordPress entirely through Composer

    Deep dive15 min read

    turkerdev/wp-composer, and an install where nothing is committed except a lock file. Core, themes and plugins as dependencies.

  • The job that ran on every push and needed to run on none

    Note2 min read

    A workflow job building documentation on every push to every branch, publishing nothing except on the default branch. A conditional inside a job means the job still starts,…

  • A Node script that stayed a Node script

    Note2 min read

    A build tool in JavaScript inside a PHP repository, examined for whether it should be rewritten and left alone. A tool written in the language of the artefacts…

  • A registry cache that filled a disk on a Sunday

    Note2 min read

    A pull-through cache with no garbage collection schedule, and a disk that filled at two in the morning. A cache grows without bound by definition and the only…

  • An image scanned on a schedule rather than on a build

    Note2 min read

    Scanning at build time answers whether the image was vulnerable when it was built, which is not the question anybody asks. A vulnerability disclosed after a build is…