Most read
Ranked by anonymous view counts over the last seven days.
A reported GitHub Actions abuse case involving Packagist repositories is a useful reminder that CI runners can become attacker-operated scanning infrastructure. Use this practical checklist to reduce untrusted trigger, token, network, action supply-chain, and monitoring risk.
AI-generated GitHub Actions YAML can be syntactically correct while creating a direct path from a forked pull request to repository credentials. Use this workflow-specific review playbook to inspect permissions, action pins, triggers, interpolation, secrets, and checkout context before merging.
A repeatable procedure for moving GitHub Actions workflows from a mutable download-artifact tag to an audited v4 commit SHA. Learn how to select the intended release, preserve documented inputs, test artifact paths, and keep future updates reviewable.
A practical GitHub Actions migration guide for replacing actions/download-artifact@v3 with v4 without silently changing what your deploy job publishes. Map common download patterns, update artifact producers, and add layout checks to a build-test-deploy pipeline.
The archive
Every article is filed under exactly one section and any number of topics.
Software Engineering
32 articles
Security
10 articles
Developer Tools
3 articles
Engineering
1 article
CI CD
1 article
Engineering
1 article
Productivity
1 article
Technology
1 article
The index
Everything published, newest first, with the reading time up front.
A protected tag can stop a version name from being moved, while an immutable release protects the published package and its associated tag after publication. Learn where each control begins and ends, and how to combine them in a practical GitHub release workflow.
A Git tag can point to the right commit while a GitHub Release still points users at the wrong package. Learn the practical difference, then use gh CLI and Git commands to create, inspect, and verify a release with a checklist your team can repeat.
Learn to distinguish a blocked Node.js event loop from slow downstream I/O using event-loop delay, event-loop utilization, request timing, and CPU measurements. Includes instrumentation code, a diagnosis matrix, and concrete remediation decisions.
Use Node.js event-loop delay and utilization metrics as an incident decision system. This guide shows what to measure first, how to distinguish synchronous blocking from CPU saturation and downstream I/O pressure, and when code changes are actually justified.
A Node.js process can remain running, pass a health check, and still make every request slow. This practical guide shows how to reproduce that failure, collect event-loop metrics beside latency, and decide whether the event loop is actually the bottleneck.
GitHub’s legacy tag-protection rules were migrated to tag rulesets after scheduled API brownouts in 2024. Use this checklist to translate patterns and permissions, create or audit repository rulesets through the supported path, and verify that release tags still point to the intended commits.
Crystal 1.15.0 introduces a new event loop implementation for UNIX operating systems, with Linux explicitly listed as supported. This guide turns that announcement into a practical Linux deployment checklist: scope, upgrade risk, workload tests, observability, and rollback planning.
Harden a repository-level GitHub Actions pipeline with immutable action references, least-privilege tokens, environment-gated deployments, artifact checksums, and audit-friendly logs. Includes a practical workflow you can adapt for Node.js projects.
Turn GitHub Actions security guidance into a time-boxed repository audit. Find mutable action references, overpowered tokens, risky triggers, and third-party dependencies, then prioritize fixes by blast radius and effort.
Build CI/CD security around the pipeline controls that matter: source, dependencies, secrets, workflow behavior, artifacts, and deployment. Compare practical tools for each control and choose a lean GitHub Actions stack for a small project or a growing engineering organization.
Written from practice
Articles come out of work we actually did -- a migration, an outage, a support pattern -- not from a topic calendar.
AI drafts are credited
Anything drafted by our writing agent is bylined "UgraByte AI" and clears the same editorial review as human-written work.
Ranked by real reading
Trending and related articles are ordered by anonymous view data, so what surfaces is what readers actually finish.
Looking for something specific