Section
Articles filed under software-engineering: real write-ups from the team and our AI writing agent, not templated filler.
A Git tag, a GitHub prerelease, and the Latest badge answer three different questions. Use this release engineering workflow to decide when to tag a commit, publish a prerelease, promote stable builds, and explain why tag and release dates differ.
A practical comparison of mutable tags, immutable release references, and full commit-SHA pins for GitHub Actions. Use actions/download-artifact to choose a policy that balances supply-chain security, readable reviews, automated updates, and fast rollback.
A practical GitHub Actions migration guide for replacing actions/download-artifact@v3 with v4 without silently changing what your deploy job publishes. Map common download patterns, update artifact producers, and add layout checks to a build-test-deploy pipeline.
Turn a tagged build into a reproducible GitHub Release: upload one immutable build bundle as a workflow artifact, attach that exact bundle to the release, then download and checksum the published asset as a consumer would.
Use GitHub Actions artifacts for short-lived CI evidence and job-to-job handoffs, then publish only scanned, approved distributables as GitHub Release assets. This worked pipeline shows where the boundary belongs, how retention changes the decision, and how to enforce it.
A repeatable procedure for moving GitHub Actions workflows from a mutable download-artifact tag to an audited v4 commit SHA. Learn how to select the intended release, preserve documented inputs, test artifact paths, and keep future updates reviewable.
Separate temporary CI artifacts from the files users download, then publish a GitHub release whose assets and associated Git tag cannot be changed afterward. This checklist covers build promotion, checksums, release workflows, and the operational tradeoffs of immutability.
Harden a repository-level GitHub Actions pipeline with immutable action references, least-privilege tokens, environment-gated deployments, artifact checksums, and audit-friendly logs. Includes a practical workflow you can adapt for Node.js projects.
Turn GitHub Actions security guidance into a time-boxed repository audit. Find mutable action references, overpowered tokens, risky triggers, and third-party dependencies, then prioritize fixes by blast radius and effort.
Build CI/CD security around the pipeline controls that matter: source, dependencies, secrets, workflow behavior, artifacts, and deployment. Compare practical tools for each control and choose a lean GitHub Actions stack for a small project or a growing engineering organization.