Loading…
Topic
152 posts about CI/CD. Every summary links to the original.
See the idea
A five-step workflow for turning agent output into versioned artifacts: scope a repo per agent, branch instead of copying, run in an isolated sandbox, gate changes with push-triggered evals, then deploy or roll back.
Buildkite splits CI into a hosted control plane and agents you run on your own machines. This comparison weighs that self-hosted agent model against fully hosted runners so you can pick the right fleet.
Anka is a Docker-like macOS virtualization layer for disposable CI environments. This architecture shows how images, Mac hosts, snapshots, build agents, and artifacts connect.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
JetBrains GameDev Day 2026 is scheduled for September 28 as a free online event for people building games, engines, tools, and production pipelines. The program covers Unity, Unreal Engine, Godot, proprietary engines, and engine-neutral infrastructure, with sessions on AI-assisted Figma-to-Unity integration, procedural content generation, ECS migration, cross-runtime C# and C++ debugging, Unreal performance profiling, and CI troubleshooting. The livestream starts at 10:00 am UTC, and recordings will be available on demand afterward; the full schedule and speaker details are still forthcoming. Watch parties are planned in Belgrade, alongside DevGAMM x FTW! attendee check-in, and at the JetBrains office in Limassol, with separate local timings and registration requirements.
TeamCity 2026.2 makes pipelines generally available on TeamCity Cloud and On-Premises, moving them beyond the Early Access Program and adding branch-aware editing, failure-tolerant job execution, promotion, job debugging, and VCS-unbound workflows. The release also expands AI capabilities: AI Assistant supports Bring Your Own Key for Anthropic, OpenAI, Google Gemini, other supported models, or a local LLM, while MCP adds pipeline management tools and OAuth/PKCE authorization. Additional changes include configurable retries for failed dependencies, IDEA plugin improvements, GitHub pull-request matching by source branch, and a choice of server- or agent-side Kotlin DSL compilation. The pipeline MCP post and delete tools require manually enabled Brave mode, and DSL compilation on agents is described as less restricting and more secure but subject to trade-offs. Bug-fix updates 2025.11.8 and 2026.1.4 also ship.
Shopify’s River is an AI agent in Slack that manages dependency and first-party application vulnerability remediation beyond the patch. It validates ledger entries against repository, pull-request, and vulnerability-tracker state, checks whether findings remain active, and updates code on the repository head when it can do so safely. River regenerates lockfiles with repository tooling, repairs upgrade failures, discards stale CI results after rebases, and avoids overwriting human work. When product or risk judgment is required, it preserves evidence and hands owners a question, then verifies the repository head, dependency graph, tracker, and ledger after merge. In its 11 days, the dependency backlog fell about 70%, while security merges through the freshness-gated queue rose from about 10% to 80%.
Public sector software must satisfy data protection, security, accessibility, procurement, supply-chain, and infrastructure requirements while protecting sensitive citizen data. Compliance failures can expose organizations to breaches, penalties, legal costs, contract disputes, and reputational damage. The brief organizes common risks around secure development, contractual and procurement obligations, audit evidence, long-term supportability, and IT governance, noting examples such as hardcoded credentials, weak cryptography, vulnerable dependencies, license conflicts, unsupported libraries, and unchecked quality issues. It recommends embedding automated SAST, secret detection, cryptography and dependency scans, license checks, quality gates, technical debt metrics, freshness tracking, testing, and time-stamped reports into IDE and CI/CD workflows, plus self-hosted or air-gapped deployment where policy requires it. These controls are presented as ways to catch problems before production, create audit trails, support handovers, and maintain compliance over long software lifecycles.
Static CI/CD credentials can leak through logs or artifacts, expose uncertainty over who copies them, and require rotation, so the article presents OIDC as an alternative for authenticating TeamCity builds. It explains the workload flow: an identity provider issues a signed JWT whose claims include validity, audience, and issuer, while the consuming service retrieves metadata and JWKS, verifies the signature, and checks those claims. The TeamCity OIDC JWT plugin makes the server an identity provider, supports RSA- or ECDSA-based signing, key rotation, configurable public issuer hosting, and extensions for HSMs or key-management services. After installation from JetBrains Marketplace, build configurations can issue tokens at startup or on demand, with default or fixed five-minute lifetimes, for direct presentation or token exchange with AWS, Google Cloud, and other OIDC services.
Open Data Hub and Red Hat OpenShift AI adopted hermetic container builds to eliminate network failures, satisfy Conforma compliance, and ensure reproducible notebook environments. Instead of pulling packages during image creation, dependencies are pinned in lockfiles, prefetched into a local cache using tools like Cachi2, and installed with the network disabled. The workflow relies on a unified Containerfile capable of running locally, within GitHub Actions, and on Konflux via Tekton tasks. To pass audit checks and avoid generic tarball downloads, the team packaged awkward binaries like ripgrep and Pandoc into multi-arch Python wheels while patching Node postinstall scripts that fetch files at install time. Upstream CentOS and downstream Red Hat Enterprise Linux dependencies are maintained in distinct lock trees to prevent subtle packaging mismatches.
Operating AI agents under binary full-access or read-only permissions creates an operational trust gap due to unpredictable model behavior across updates. The graduated autonomy architectural pattern closes this gap by dynamically granting or revoking tool permissions through sustained reliability scoring. A scoring engine computes a composite score across five weighted dimensions over a rolling 50-action window, mapping agents across four tiers from probation to full autonomy. In-process pre-execution filters check for prompt injection and sensitive targets, while Amazon Bedrock AgentCore Gateway and Cedar policies strictly enforce deny-by-default access at the infrastructure level. Post-execution state capture in Amazon DynamoDB supports reversibility, and AWS CodePipeline delivery gates block releases failing adversarial evaluation benchmarks.
Deploying Red Hat OpenShift AI manually across multiple environments is error-prone due to the numerous required dependencies, including certificate managers, job queuing systems, and GPU operators. To streamline this lifecycle, the odh-gitops repository introduces the rhai-on-openshift-chart Helm chart. The chart automates operator provisioning through Operator Lifecycle Manager and configures custom resources such as DataScienceCluster. Dependency resolution is controlled via a tri-state model that automatically installs prerequisites like cert-manager and Red Hat Connectivity Link when dependent components are enabled. Using this chart, teams can deploy full platform installations or minimal inference stacks through standard Helm CLI commands or Argo CD GitOps pipelines.
Responsible AI adoption struggles when organizations rely on static policy documents instead of integrating guardrails directly into engineering workflows. Developers under delivery pressure inevitably turn to unapproved shadow AI when sanctioned routes introduce friction. Stack Overflow survey data reveals that 84% of respondents use or plan to use AI tools, yet more developers distrust AI accuracy than trust it. Operational controls must be embedded inside repositories, build pipelines, and pull request reviews to match specific failure modes like those listed by OWASP. Organizations achieve dependable adoption by pairing automated controls with clear role ownership, psychological safety, role-specific training, and outcome-based engineering metrics.
GitHub Agentic Workflows added support for Docker Sandboxes as an agent runtime, allowing CI coding agents to operate within microVM isolation. Useful AI agents require broad capabilities like executing arbitrary shell commands and launching containers, which elevates risk on shared CI runners. With the docker-sbx runtime, agents receive root privileges and a private Docker daemon inside a dedicated microVM while external repository access and network traffic remain restricted. In a demonstration, an agent ran on an Ubuntu runner, executed Java 21 integration tests with PostgreSQL via Testcontainers, identified an email case-sensitivity defect, applied a code fix, and opened a draft pull request. The complete workflow executed in eleven minutes and sixteen seconds while confining modifications strictly to source files.
Ansible development workspaces in Red Hat Ansible Automation Platform leverage Red Hat OpenShift Dev Spaces to solve environment drift and lengthy developer onboarding. Instead of configuring local environments, developers access cloud-hosted VS Code instances via a web browser using declarative devfile.yaml configurations. The platform enforces immutability with a read-only /var directory at runtime, preventing arbitrary package installations that cause configuration drift. To address differing domain requirements across teams without creating bloated monolithic images, the solution implements a four-tiered image strategy based on OpenShift BuildConfigs and ImageStreams. When base container images receive security patches, the dependent image layers automatically rebuild throughout the entire chain.
Technical project managers historically spend 60 to 70 percent of their working time managing routine coordination tasks, including manual spreadsheet updates and obsolete status reporting. Engineering organizations are addressing this overhead by integrating generative artificial intelligence, large language models, and agentic workflows into delivery pipelines. Automated agents ingest telemetry directly from Git commits, pull request comments, and CI/CD logs to assess system state while machine learning models execute Monte Carlo simulations to forecast delivery risks. Although this automation reduces administrative overhead below 30 percent, implementations face practical obstacles like inconsistent ticket definitions across teams and algorithmic over-reliance on uncontextualized historical patterns. Consequently, technical project managers are transitioning into strategic roles that coordinate hybrid human-agent workforces while providing critical judgment and organizational context.
Security incidents involving AI agents, such as the OpenAI and Hugging Face event where attackers executed 17,600 actions, demonstrate that system security cannot rely entirely on manual human review. Managing agent velocity requires dedicated system-level controls to properly constrain, observe, and govern their behaviors during execution. To secure autonomous development workflows, Docker Sandboxes allow AI agents to operate within GitHub Actions, run Testcontainers tests, adjust code, and automatically generate draft pull requests inside isolated environments. In addition, escalating software supply-chain threats and the increased volume of AI-generated code drive the adoption of Docker Hardened Images and Docker Extended Lifecycle Support. These updates incorporate software built from source into container images, extend security patch coverage past end-of-life milestones, and move organizational policy enforcement directly onto developer machines.
The OpenAI and Hugging Face security incident involved 17,600 attacker actions, demonstrating that AI agent security cannot rely exclusively on manual human review. Modern development workflows require systems controls to constrain, observe, and govern autonomous agents operating at high speeds. To address related isolation and automation requirements, developers can run AI agents inside GitHub Actions using Docker Sandboxes to execute Testcontainers tests, fix code, and generate draft pull requests. In addition, Docker Extended Lifecycle Support provides continued security coverage past software end of life while moving policy enforcement directly to developer workstations. Finally, Docker Hub has transitioned Docker Verified Publisher applications to a self-serve model, enabling publishers to distribute verified content directly to developers.
AI hallucinations are coherent, confident outputs that are factually wrong, fabricated, or unsupported, appearing in chatbots, image generators, and multimodal systems. Generative models predict likely continuations rather than retrieve guaranteed facts, while training incentives, limited or flawed data, generation settings, and error compounding in reasoning models can increase the risk. Examples include Google Bard’s incorrect JWST claim, Air Canada’s nonexistent bereavement policy, Microsoft Sydney’s erratic responses, and fabricated legal citations that led to sanctions. Hallucinations create enterprise risks involving safety, liability, compliance, security, reputation, and trust; recommended controls include guardrails, source verification, adversarial testing, monitoring, human review, retrieval-augmented generation, governed data, and evaluation throughout development and deployment.
Shopify’s largest mobile app had become blocked by flaky end-to-end tests, which failed when screens took longer to render and had been removed from pull-request checks. Since 2023, tests used Appium through WebdriverIO and React Native Test IDs, allowing timing shortcuts and assertions about component-tree presence rather than what merchants could see or use. The rebuild hides Appium behind a strict builder-style wrapper that requires an assertion after every action; computer vision uses screenshots, PaddleOCR for text, and OpenCV for icons, with Test IDs as an opt-in fallback. After promotion into blocking CI, stability reached 98% of individual test successes over total runs, up from 50% with the old API, on two platforms. A pre-promotion flakiness gate rejects tests that exceed a failure threshold across repeated runs, while remaining failures largely involve network problems or simulator boot failures.
Agents Week introduced a series of products and primitives across Cloudflare to support an Agentic Internet where autonomous software and humans interact. Developing capable agents requires addressing technical challenges spanning identity, communication, orchestration, memory, observability, and security. Cloudflare introduced the Agent Development Lifecycle alongside tools like Cloudflare Agents for live tracing, replay, and human-in-the-loop approvals. The releases also included programmable CI/CD pipelines capable of repairing failures, Cloudflare Wallets for agent transactions, and Kitesurf, an agent-first browser running in V8 isolates. New protocols and tools like WebMCP, MCPv2, and Cloudflare AI Search aim to make web data and applications readable, discoverable, and searchable by autonomous software.
Thumbtack migrated 1,500 Android screenshot tests from Firebase Test Lab to Roborazzi to eliminate slow and error-prone testing on remote emulators. The engineering team ported test suites from androidTest to test in batches of 20, adjusting test rules and annotations for Robolectric. Because Roborazzi runs in a single JVM process with parallel execution, the team had to debug shared font cache pollution and cross-platform shadow rendering inconsistencies between macOS and Debian. They resolved configuration repetition by mapping Robolectric annotations into module-level robolectric.properties files and avoided stale cached images by clearing Roborazzi's cache via a custom Gradle task. The migration significantly decreased CI runtimes while making local test recording and verification easier.
Sentry automated its internal debugging and issue triage workflows to handle bugs and pull requests generated by AI agents. The company deployed Seer, an AI-powered debugging agent, across several repositories to determine root causes, create fix plans, and open pull requests. To manage the resulting influx of pull requests, Sentry built an automated Slack routine powered by Claude that periodically scans for unaddressed pull requests opened within four hours. The routine asks Seer to identify relevant reviewers using GitHub commit history, verifies pull request status, and tags engineers to request merges, closures, or feedback. Early metrics show a 21 percent increase in pull request action rates, a 13 percent increase in 48-hour response rates, and a 12.5 percent rise in pull requests closed without merging due to duplicate or expanded fixes.
Coding agents often consolidate full-stack features into monolithic pull requests spanning thousands of lines, resulting in delayed reviews and lower feedback quality. To resolve this bottleneck, engineers can decompose comprehensive features into ordered, single-concern layers using GitHub stacked pull requests and the gh-stack CLI extension. Distinct specialized agents handle individual branches—ranging from foundational data access modules up to client interfaces—while CI checks continuously evaluate each layer against the stack base. When reviewers request upstream modifications, running gh stack sync executes a cascading rebase across all dependent branches, preserving commit signatures and keeping the entire pull request chain mergeable.
The best engineering reads, once a week.
