Continuous Integration

This hardening effort was directly triggered by the recent Trivy supply chain compromise, which impacted some repositories in my workplace. That prompted a full review of my own repository controls. If you want more information about the incident and the response, the following two links are worth reading first: Incident analysis: Trivy Compromised a Second Time (StepSecurity) Official disclosure and remediation guidance: Aqua Security discussion #10425 The aim of my actions to my repository was not to chase perfect security. It was to put in place some practical controls that are easy to maintain and that reduce real risk in day-to-day development. ...

This post is more of a note to self. PaperMod Update So last week, after a very long time, I actually spent some time doing some housekeeping on this blog. I decided to check Hugo versions and what’s new on paperMod. Found that there were many new things. Pulled in the latest and built the site only to realize it broke! How did you get the latest version? git submodule update --recursive --remote So some of the features introduced in the latest version of PaperMod weren’t supported in the version of Hugo that I had running, which was v0.109.0. I am not aware of what features exactly, so can’t really tell you. I didn’t have the time to explore. ...

A year or so ago, I was looking into ways to improve releases at my current job. We have a whole bunch of small legacy .NET applications that until 3 years ago were manually be deployed into a server that was provided to us by a third party. After migrating things to Azure, the sky was the limit for us. It was time to take control of our releases and make it better. ...

Background I am proud to say that I work in a team where we follow Test Driven Development and pair programming. This has been a life changing experience for me as for several years, I had been writing code first and only writing tests after I thought it was doing what it meant to be doing which often lead to tests that only tested the bare minimum or lead to poorly thought out code that was badly coupled. However, since the last quarter of 2020, I have been practicing TDD with my pair programming partner on every new project except for when it came to working on legacy code where it would take us, much longer to refactor and make the code testable in the first place. ...

What are Azure Logic Apps? Azure Logic Apps are an Azure service that lets you visually build integrated solutions to connect several different apps and services together, and comes with a click and select interface. It enables you automate business processes without writing any code at all! What is business process? A business process or workflow is a sequence of tasks that produce some sort of outcome, which may be some data, decision, notification. ...

How many times have you as a software engineer worked on a large feature, in an isolated branch that only got merged to the mainline branch when it is time to actually release the feature and then struggled for hours and sometimes days with the merge conflicts, simply because many other changes were contributed to the main branch in the meanwhile? If your answer is many times, then you really might benefit from this. ...