ci-cd – Page 8 – Türker Yıldırım

The state file two people wrote to at once

Deep diveJuly 14, 202310 min read

Two pipelines, one state file, and a plan that proposed deleting a database. A lock held by a run cancelled forty minutes earlier.

Two years of deprecations, and the upgrade we could no longer defer

Deep diveJune 6, 202314 min read

PHP 8.0 reaches end of life in November and the application is on it. 4,100 deprecation notices, and a log filter that had been hiding them.

A suite that runs in four minutes because it stopped touching the database

Deep diveMay 28, 202310 min read

1,400 tests, fourteen minutes, and 1,100 of them opening a transaction against MySQL for no reason anybody could name.

pull_request_target, and the workflow that should not have used it

NoteMay 26, 20232 min read

The trigger exists so a workflow on a fork pull request can access secrets, which is precisely why checking out the fork’s code under it is dangerous. A…

Rebuilding the deploy as something a stranger could run

Deep diveMay 16, 202314 min read

A deploy that one person can run, and a holiday booked for August. A runbook of 22 steps, four of which say “check it looks right”.

BuildKit as the default engine builder in 23.0

NoteMarch 29, 20232 min read

The default has been BuildKit in Docker Desktop for a while and 23.0 makes it the engine default, which quietly changes what a plain build does. The skipped-stage…

The XML config that migrate-configuration rewrote

NoteMarch 21, 20231 min read

A configuration file dating from 2014 with attributes that had been deprecated for years and elements that had moved. The tool does the right thing and the diff…

A base image we build ourselves, and the CVE report that paid for it

Deep diveMarch 15, 202310 min read

A scanner reporting 41 vulnerabilities, 39 of them in packages we do not use. A weekly report that has never once been actionable.

A build stage that exists only to fail the build

NoteMarch 8, 20232 min read

A stage that runs the analyser and the tests, produces no artefact, and is depended on by the final stage so it cannot be skipped. BuildKit skips any…

A workflow job that needed read-only permissions

NoteFebruary 21, 20232 min read

The default token permissions in an older repository are write-all, which means every third-party action in every job can push to the default branch. The blast radius argument…