Most read
Ranked by anonymous view counts over the last seven days.
A repeatable procedure for moving GitHub Actions workflows from a mutable download-artifact tag to an audited v4 commit SHA. Learn how to select the intended release, preserve documented inputs, test artifact paths, and keep future updates reviewable.
A practical GitHub Actions migration guide for replacing actions/download-artifact@v3 with v4 without silently changing what your deploy job publishes. Map common download patterns, update artifact producers, and add layout checks to a build-test-deploy pipeline.
The archive
Every article is filed under exactly one section and any number of topics.
Software Engineering
32 articles
Security
10 articles
Developer Tools
3 articles
Engineering
1 article
CI CD
1 article
Engineering
1 article
Productivity
1 article
Technology
1 article
The index
Everything published, newest first, with the reading time up front.
Compare native CI controls, specialist security tools, and unified platforms using a proof-of-value matrix tied to OWASP CI/CD risks. This worksheet tests real coverage for secrets, code, dependencies, infrastructure, artifact integrity, visibility, and developer friction.
Use a small GitHub Actions repository to turn OWASP CI/CD risks into concrete findings: excessive token permissions, poisoned pull-request execution, mutable dependencies, unverified artifacts, and missing evidence. The result is a repeatable review worksheet and a safer workflow design.
Create GitHub Releases only from controlled version tags, keep build jobs read-only, and give release publishing a short-lived contents: write token. Compare a release-creation action plus GitHub CLI asset uploads with softprops/action-gh-release.
Turn OWASP CI/CD risks 8, 9, and 10 into a repeatable GitHub Actions pull-request review. Use a worked workflow example to find ungoverned actions, weak artifact checks, and missing deployment evidence before code reaches production.
Spring Tools 5.2 introduces an experimental Claude Code plugin and embedded MCP server, but safe use depends more on workspace isolation than on prompts. This workflow shows a minimal validation change, test contract, secret-safe project preparation, and rollback procedure.
A reported GitHub Actions abuse case involving Packagist repositories is a useful reminder that CI runners can become attacker-operated scanning infrastructure. Use this practical checklist to reduce untrusted trigger, token, network, action supply-chain, and monitoring risk.
Reported abuse involving Packagist repositories shows how a CI workflow can become a free scanning and egress service. Use this threat model and audit checklist to constrain triggers, tokens, runners, dependency installation, network access, and detection.
AI-generated GitHub Actions YAML can be syntactically correct while creating a direct path from a forked pull request to repository credentials. Use this workflow-specific review playbook to inspect permissions, action pins, triggers, interpolation, secrets, and checkout context before merging.
Turn NIST’s generative AI risk guidance into a practical release gate for a coding assistant, repository chatbot, or internal support bot. Use this checklist to test data exposure, harmful outputs, human review, evaluation coverage, and incident response before enabling real users.
The event loop is the beating heart of every Node.js server and browser tab. Understanding it is the difference between writing code that happens to work and code that works because you know why.
Written from practice
Articles come out of work we actually did -- a migration, an outage, a support pattern -- not from a topic calendar.
AI drafts are credited
Anything drafted by our writing agent is bylined "UgraByte AI" and clears the same editorial review as human-written work.
Ranked by real reading
Trending and related articles are ordered by anonymous view data, so what surfaces is what readers actually finish.
Looking for something specific