Skip to content

Topic

CI/CD pipelines

Automated workflows that build, test, and deploy software on code commits, typically run via tools like GitHub Actions, GitLab CI, or Jenkins.

Current stories

build1 publisherOne report

ECS earlySuccessCriteria ends automatic rollback once a partial rolling deployment reports success

Amazon ECS's earlySuccessCriteria can close a rolling deployment at 90 of 100 healthy tasks, ending automatic rollback for the service at that point. EventBridge and CloudTrail log that early finish exactly like a full rollout, so anything reading those events cannot tell a 90-task fleet from a 100-task one.

Publishers:dev.to

Reality

Evidence55
Adoption
Insufficient
Hype gap0
Incentives
Insufficient
Confidence50
build1 publisherOne report

Registry logs show Compose v5.5.1 ignoring pull_policy windows on explicit pulls

Docker Compose v5.5.1 hit the registry on all three explicit pulls in a developer's test, though its v5.5.0 changelog says pull now honors refresh windows. For CI pipelines built around an explicit pull step, the upgrade bought no fewer registry calls in that test.

Publishers:dev.to

Reality

Evidence55
Adoption
Insufficient
Hype gap+25
Incentives
Insufficient
Confidence50
build1 publisherOne report

The App Runner exit starts with two IAM roles you write yourself

A dev.to walkthrough says AWS App Runner no longer accepts new services, and the Amazon ECS Express Mode path it demonstrates opens with an execution role, an infrastructure role, and a public container image.

Publishers:dev.to

Reality

Evidence45
Adoption12
Hype gap+25
Incentives22
Confidence48
build1 publisherOne report

NCCoE's notional DevSecOps model gates every promotion between its seven phases

The NCCoE has decomposed SSDF practices into a seven-phase lifecycle in which each phase is a separate environment and no change advances without clearing a control gate. The mapping back to the SSDF itself is future work.

Publishers:pages.nist.gov

Reality

Evidence68
Adoption
Insufficient
Hype gap0
Incentives45
Confidence62
build1 publisherOne report

The archrule glob makes your package tree the architecture spec

The New Stack's case for moving architecture rules out of the wiki and into pytest holds up on mechanism. The two sample rules also show the bill: enforcement runs on module-name globs, and the domain-purity check bans two libraries where its own docstring promises an allowlist.

Publishers:thenewstack.io

Reality

Evidence55
Adoption
Insufficient
Hype gap+30
Incentives30
Confidence62
build1 publisherOne report

Putting the deploy command next to the app leaves CI one verb to call

An Nx deploy target holds the whole build, push and deploy line, so CI only calls it and cannot keep a drifting copy. The tradeoff is a production shell string that nothing validates and a public-access flag one diff away.

Publishers:dev.to

Reality

Evidence55
Adoption
Insufficient
Hype gap+20
Incentives30
Confidence45