Topic: ci
-
Binding npm and PyPI publishing identity to approved release artifacts
OIDC trusted publishing removes stored publishing tokens, but its security still depends on the authorized workflow. Separate building from publishing, protect approvals, and verify the artifact's identity instead of treating provenance as a malware verdict.
-
The test pyramid: which test belongs on which level
Many fast unit tests, fewer integration tests, very few end-to-end tests: the shape follows from runtime, isolation and the diagnostic value of a failure, not from a rule. An inverted pyramid (the "ice-cream cone") is slow, brittle and hard to diagnose.
-
Containing npm worm propagation across developer machines and publishing accounts
ChainDrop and the Tensorlake compromise show how installation-time credential theft can become unauthorized package publishing. Containment must cover dependency execution, publisher permissions, repository persistence, and contaminated build outputs.
-
Git's "detected dubious ownership in repository" error and the safe.directory fix
Git refuses to operate in a repository owned by a different user than the one running the command, quoting 'fatal: detected dubious ownership in repository at'. The article explains the CVE-2022-24765 fix behind it, when a per-repo safe.directory entry is right, and why chown is the better fix in containers and CI.
-
Package release cooldowns: exact settings, units, and enforcement boundaries
Release-age controls differ across npm, pnpm, uv, Renovate, and Dependabot. Configure the correct units, check timestamp handling and transitive resolution, and keep an explicit path for urgent security updates.
-
git exit codes an agent can rely on: diff --exit-code, ls-remote --exit-code, and bisect run's 125
Most git porcelain commands only document 'non-zero on failure' without a fixed numeric table, but three commands publish an exact, citable contract: git diff/--quiet uses 1 for differences, git ls-remote --exit-code uses 2 for no matching refs, and git bisect run reserves 125 to mean 'skip this commit,' not 'bad.' A conflicted merge is signalled by state (MERGE_HEAD), not a documented number.
-
A malicious package was installed: contain execution before replacing credentials
A proposed response sequence for malicious npm or Python packages: stop execution and publishing, preserve evidence, revoke exposed credentials from a clean system, inspect repository persistence, rebuild, and verify recovery.
-
LiteLLM 1.107.0: checking artifact exposure without restarting compromised Python
The October LiteLLM compromise affected PyPI wheels and container images. Check preserved metadata before starting Python, rebuild affected environments, and revoke credentials that the compromised system could access.
-
Running Homebrew non-interactively on a build agent: NONINTERACTIVE, env vars and Brewfile
Homebrew's installer, its auto-update and analytics behaviour, and formula versions can all be controlled without a prompt for use on a CI runner, and a Brewfile makes the installed set reproducible across runners.
-
Comparing the minimum of repeated runs flags benchmark regressions on shared CI runners with fewer false alarms than comparing means
Hypothesis: for CPU-bound microbenchmarks executed on noisy shared CI runners, a regression check on the minimum of N repeated runs raises fewer false alarms and misses fewer injected slowdowns than the same check on the mean, because interference adds delay in one direction only; the advantage is predicted to vanish for I/O-bound benchmarks.
Machine-readable: JSON