Most read
Ranked by anonymous view counts over the last seven days.
GitHub immutable releases lock published release assets and tags, but successful adoption depends on choosing the right repositories and designing a correction path for release notes. This playbook walks through a low-risk test release, verification checks, CI changes, and an exception process that never rewrites shipped artifacts.
A Git tag can point to the right commit while a GitHub Release still points users at the wrong package. Learn the practical difference, then use gh CLI and Git commands to create, inspect, and verify a release with a checklist your team can repeat.
A Git tag, a GitHub prerelease, and the Latest badge answer three different questions. Use this release engineering workflow to decide when to tag a commit, publish a prerelease, promote stable builds, and explain why tag and release dates differ.
Build a reliable four-job GitHub Actions pipeline using v4 artifacts, artifact IDs, checksum verification, and a separate release-publishing step. Learn why workflow artifacts are not the same thing as GitHub Release assets.
The archive
Every article is filed under exactly one section and any number of topics.
Software Engineering
66 articles
Security
11 articles
Developer Tools
4 articles
Engineering
2 articles
Engineering
1 article
CI CD
1 article
Development
1 article
Productivity
1 article
Release Management
1 article
Technology
1 article
The index
Everything published, newest first, with the reading time up front.
A practical process for deciding which GitHub secret-scanning patterns should block pushes, which need tuning, and which should be excluded. Use a small evidence-based decision matrix to reduce developer friction without turning off meaningful prevention.
A buyer-oriented framework for selecting CI/CD security tools based on the risks in your actual delivery pipeline: code, dependencies, secrets, workflows, artifacts, and continuous validation.
Use GitHub’s selectable push-protection patterns to block credentials that create immediate access, warn on ambiguous findings, and track bypasses as measurable policy debt. Includes a pilot plan, a tiering matrix, and exception metrics.
AI-generated pull requests can pass every visible test while quietly creating duplicate policy, unsafe boundaries, and unsupported dependencies. Use this five-gate, 10-point rubric to decide what can merge, what needs follow-up, and what needs an architectural redesign.
Use this five-minute GitHub Actions review checklist to block unsafe permissions, secret exposure, third-party action drift, untrusted artifacts, and missing audit signals before a workflow change merges.
Stop comparing CI/CD security products as interchangeable suites. Use a weighted requirements matrix that scores code, dependencies, secrets, builds, artifacts, and pipeline controls against your CI platform, enforcement boundaries, and false-positive tolerance.
Build release artifacts, changelogs, checksums, and draft releases automatically while keeping version approval, final release-note review, publishing, and rollback decisions with people. This reference design uses protected branches, immutable tags, GitHub Environments, and an idempotent draft policy.
Use this pull-request review checklist to evaluate GitHub Actions workflows for excessive permissions, unsafe third-party actions, artifact promotion gaps, secret exposure, runner isolation, and missing audit evidence. Each control is mapped to the OWASP Top 10 CI/CD Security Risks and CISA/NSA CI/CD guidance.
Harden a GitHub Actions pipeline with a practical workflow baseline and repository checklist mapped to OWASP CI/CD risks. See exactly where to set token permissions, protect deployments, validate artifacts, pin actions, and retain useful audit evidence.
Compare native CI controls, specialist security tools, and unified platforms using a proof-of-value matrix tied to OWASP CI/CD risks. This worksheet tests real coverage for secrets, code, dependencies, infrastructure, artifact integrity, visibility, and developer friction.
Written from practice
Articles come out of work we actually did -- a migration, an outage, a support pattern -- not from a topic calendar.
AI drafts are credited
Anything drafted by our writing agent is bylined "UgraByte AI" and clears the same editorial review as human-written work.
Ranked by real reading
Trending and related articles are ordered by anonymous view data, so what surfaces is what readers actually finish.
Looking for something specific