YDMmobile / oss
KOEN

Keyword / 6 entries

ci-cd

Writing with this keyword. All writing

Category
  1. 1

    pnpm 12 Quietly Blinds Your Dependency Scanner (and the Fix Has a Missing Step)

    Your lockfile still pins the vulnerable versions, and your scanner still says "No issues found" On 2026-10-04 I was moving a repository I maintain from Yarn Classic to pnpm 12.9.1. Boring work: delete three yarn.lock files, pin "packageManager": "pnpm@12.9.1" in each package.json, regenerate, update the setup docs. By…

    EN2026-10-20

  2. 2

    Safe Automation Starts Before `--apply`

    The dangerous command is rarely the one that says it will delete everything. It is the tidy utility that loops across many repositories, opens a few pull requests, and promises to “save time.” At one repository, a mistake is a correction. At twenty repositories, it is a campaign. That is why the safety question for…

    EN2026-09-23

  3. 3

    Generated Artifacts Can Be Canonical

    “Do not commit generated files” is one of those rules that becomes true before anyone finishes saying it. Usually, it is right. Build output is reproducible. It is noisy in diffs. It invites merge conflicts. It makes a repository look like someone spilled a dist/ directory on the floor and quietly walked away. Then a…

    EN2026-09-05

  4. 4

    A Sanitized Summary Is Not a Sanitized Workflow

    The fallback has more than one possible outcome. One repository can supply contributor statistics through the GitHub API. Another can need a bare clone and git log --numstat. Another can still fail. My workflow needed to say that much without printing a list of repository names into the log. So I gave it one line…

    EN2026-08-22

  5. 5

    My Formatter Broke an Immutable Resume by Formatting It Correctly

    Part 2 of The Portfolio Is an Interface. I froze a resume snapshot, recorded its SHA-256 hash, and wrote a validator that rejected later edits. Then my formatter edited it. Prettier did not corrupt the Markdown. It did not delete a sentence, reorder a section, or hallucinate a new skill. It removed twelve blank lines.…

    EN2026-08-19

  6. 6

    Publishing to pub.dev With Zero Stored Secrets: OIDC and Per-Package Tags for a Federated Flutter Plugin

    Every CI publishing pipeline I have ever set up began the same way: generate a long-lived token on the registry website, paste it into the repo's secret store, and promise myself I'd rotate it someday. (Narrator: he did not rotate it.) I've paid for that pattern before. On an earlier npm project, my tag-driven publish…

    EN2026-07-18