Most read
Ranked by anonymous view counts over the last seven days.
GitHub immutable releases lock published release assets and tags, but successful adoption depends on choosing the right repositories and designing a correction path for release notes. This playbook walks through a low-risk test release, verification checks, CI changes, and an exception process that never rewrites shipped artifacts.
A Git tag can point to the right commit while a GitHub Release still points users at the wrong package. Learn the practical difference, then use gh CLI and Git commands to create, inspect, and verify a release with a checklist your team can repeat.
A Git tag, a GitHub prerelease, and the Latest badge answer three different questions. Use this release engineering workflow to decide when to tag a commit, publish a prerelease, promote stable builds, and explain why tag and release dates differ.
Build a reliable four-job GitHub Actions pipeline using v4 artifacts, artifact IDs, checksum verification, and a separate release-publishing step. Learn why workflow artifacts are not the same thing as GitHub Release assets.
The archive
Every article is filed under exactly one section and any number of topics.
Software Engineering
66 articles
Security
11 articles
Developer Tools
4 articles
Engineering
2 articles
Engineering
1 article
CI CD
1 article
Development
1 article
Productivity
1 article
Release Management
1 article
Technology
1 article
The index
Everything published, newest first, with the reading time up front.
Use a small GitHub Actions repository to turn OWASP CI/CD risks into concrete findings: excessive token permissions, poisoned pull-request execution, mutable dependencies, unverified artifacts, and missing evidence. The result is a repeatable review worksheet and a safer workflow design.
Create GitHub Releases only from controlled version tags, keep build jobs read-only, and give release publishing a short-lived contents: write token. Compare a release-creation action plus GitHub CLI asset uploads with softprops/action-gh-release.
Turn OWASP CI/CD risks 8, 9, and 10 into a repeatable GitHub Actions pull-request review. Use a worked workflow example to find ungoverned actions, weak artifact checks, and missing deployment evidence before code reaches production.
Spring Tools 5.2 introduces an experimental Claude Code plugin and embedded MCP server, but safe use depends more on workspace isolation than on prompts. This workflow shows a minimal validation change, test contract, secret-safe project preparation, and rollback procedure.
A reported GitHub Actions abuse case involving Packagist repositories is a useful reminder that CI runners can become attacker-operated scanning infrastructure. Use this practical checklist to reduce untrusted trigger, token, network, action supply-chain, and monitoring risk.
Reported abuse involving Packagist repositories shows how a CI workflow can become a free scanning and egress service. Use this threat model and audit checklist to constrain triggers, tokens, runners, dependency installation, network access, and detection.
AI-generated GitHub Actions YAML can be syntactically correct while creating a direct path from a forked pull request to repository credentials. Use this workflow-specific review playbook to inspect permissions, action pins, triggers, interpolation, secrets, and checkout context before merging.
Turn NIST’s generative AI risk guidance into a practical release gate for a coding assistant, repository chatbot, or internal support bot. Use this checklist to test data exposure, harmful outputs, human review, evaluation coverage, and incident response before enabling real users.
The event loop is the beating heart of every Node.js server and browser tab. Understanding it is the difference between writing code that happens to work and code that works because you know why.
Written from practice
Articles come out of work we actually did -- a migration, an outage, a support pattern -- not from a topic calendar.
AI drafts are credited
Anything drafted by our writing agent is bylined "UgraByte AI" and clears the same editorial review as human-written work.
Ranked by real reading
Trending and related articles are ordered by anonymous view data, so what surfaces is what readers actually finish.
Looking for something specific