---
title: "CI/CD"
description: "152 posts about CI/CD, summarised, each linking to the original."
---

# CI/CD
> 152 posts about CI/CD, summarised, each linking to the original.

## Articles

### [The Software Supply Chain Is Under Siege. Devs Are Still the First Line of Defense](https://yomu.fyi/post/the-software-supply-chain-is-under-siege-devs-are-still-the-first-line.md)
- Company: [Docker](https://yomu.fyi/company/docker.md)
- Author: Jin Kim
- Published: Aug 4, 2026
- Type: Explainer

A research report by Omdia examines escalating software supply chain security risks driven by growing dependencies on third-party code, open-source software, and artificial intelligence. Over three-fourths of surveyed organizations experienced a software supply chain incident in the preceding year, with known vulnerabilities in third-party software representing the most common exploit vector. Surveyed respondents ranked AI technology as their top supply chain concern, alongside broader issues involving vulnerability remediation and code composition identification. While shifting security left is a high priority for 98% of organizations, 45% still lack confidence in the robustness of their supply chain defenses. Although secure container libraries and Software Bills of Materials provide measurable mitigation benefits, many organizations only generate inventories on a case-by-case basis.


### [Databricks Completes Acquisition of Panther: Accelerating the Security Lakehouse Era](https://yomu.fyi/post/databricks-completes-acquisition-of-panther-accelerating-the-security.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Andrew Krioukov, Jack Naglieri, Taylor Kain, Dave Herrald
- Published: Aug 3, 2026
- Type: Announcement

Databricks says it has completed its acquisition of Panther, an AI SOC platform, to accelerate its security lakehouse strategy. The combination pairs Lakewatch’s open, governed foundation for collecting, retaining, and analyzing petabyte-scale security telemetry with Panther’s operational SOC workflows and more than 100 out-of-the-box integrations. Panther adds detections-as-code, CI/CD-based authoring and deployment, and AI-native triage and investigation that correlate cloud, identity, SaaS, IT, and business data. The announcement presents the combined platform as a way to retain high-fidelity telemetry, preserve data ownership through open standards including OCSF, Spark, Unity Catalog, Delta, Parquet, and SQL, and automate investigations, detection refinement, and response workflows for modern security operations.


### [How to Self-Host a Validated AI Coding Assistant with NVIDIA NeMo Guardrails](https://yomu.fyi/post/how-to-self-host-a-validated-ai-coding-assistant-with-nvidia-nemo-guar.md)
- Company: [NVIDIA](https://yomu.fyi/company/nvidia-developer-blog.md)
- Author: Tanya Lenz
- Published: Jul 29, 2026
- Type: Tutorial

Deploying AI coding assistants in regulated or sovereign environments presents risks around data privacy, hallucinated dependencies, and auditability. This tutorial outlines a self-hosted architecture deploying StarCoder2-7B as an NVIDIA NIM endpoint served entirely from local GPUs. NVIDIA NeMo Guardrails sits as an OpenAI-compatible proxy between developer IDEs and the model to intercept and reject requests for restricted or human-only code paths. Downstream CI gates catch package hallucinations and verify changes, while commit trailers and a Prometheus and Grafana metrics loop monitor defect escape rates. Because the model remains distinct from the external policy and validation layers, teams can incrementally adopt components or upgrade models without rearchitecting the pipeline.


### [Tame Dependabot: Group your updates, slow the cadence, keep security fast](https://yomu.fyi/post/tame-dependabot-group-your-updates-slow-the-cadence-keep-security-fast.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: Bruno Borges
- Published: Jul 29, 2026
- Type: Problem & solution

Dependabot often floods repository maintainers with individual daily pull requests for single patch bumps, wasting review and continuous integration resources. Microsoft's GCToolkit project mitigated this issue by updating its dependabot.yml configuration to group dependency updates using wildcard patterns and slowing the schedule interval to monthly. The project also expanded coverage to include Maven alongside GitHub Actions so all relevant package ecosystems receive managed updates. Because Dependabot processes security alerts independently of regular version schedules and enforces a default three-day package cooldown, critical vulnerability fixes remain fast while routine maintenance noise drops significantly.


### [Developers are attached to tools because tools encode trust](https://yomu.fyi/post/developers-are-attached-to-tools-because-tools-encode-trust.md)
- Company: [Stack Overflow](https://yomu.fyi/company/stack-overflow.md)
- Author: Ryan Donovan
- Published: Jul 29, 2026
- Type: Explainer

Traditional developer tools like Vim, Emacs, and IDEs earn trust through predictability, bounded roles, and muscle memory developed over time. In contrast, agentic coding tools operate across the entire software development lifecycle using ambiguous natural language, rapidly generating vast amounts of code that developers do not inherently trust. This influx shifts development bottlenecks from code authoring to code review, validation, and infrastructure cost management. Tooling additions such as automated code reviewers, context managers, and memory systems cannot repair broken software development lifecycles unless organizations actively adapt their culture and workflows. Teams can establish trust in agentic environments by providing explicit contextual specifications, reusing verified components to avoid duplicate implementations, and restricting non-deterministic artificial intelligence to appropriate problem domains.


### [Securing Infrastructure at Scale: Introducing Pinterest’s Resource Provisioner Pipeline (RPP)](https://yomu.fyi/post/securing-infrastructure-at-scale-introducing-pinterest-s-resource-prov.md)
- Company: [Pinterest](https://yomu.fyi/company/pinterest.md)
- Author: Pinterest Engineering
- Published: Jul 22, 2026
- Type: Problem & solution

Managing Infrastructure as Code across distributed repositories presents significant security and operational challenges. Pinterest developed the Resource Provisioner Pipeline (RPP), a proprietary Terraform execution engine, to securely deploy and manage AWS infrastructure across hundreds of workspaces. The pipeline utilizes centralized GitHub composite actions triggered by pull request events and enforces dual human approvals. To maintain least privilege, RPP uses GitHub OpenID Connect authentication to assume a central identity before validating repository paths and down-scoping to specific team execution roles. Automated checks include backend state validation, linting, plan generation, Semgrep static analysis, and optional LocalStack testing before deliberate comment-driven deployments execute.


### [Branching databases like code: a CI/CD pattern for Lakebase, in production at Glaspoort](https://yomu.fyi/post/branching-databases-like-code-a-ci-cd-pattern-for-lakebase-in-producti.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Hadi Farhat, Gideon Spierings, Ricardo de Vries, Raymon Veldman
- Published: Jul 20, 2026
- Type: Problem & solution

Glaspoort replaced a sprawl of outdated, one-off BI reports with a custom application that combines Databricks analytical tools with Lakebase, a serverless Postgres OLTP database. The application keeps curated lakehouse data in a read-only schema while application state occupies a separate schema, and supports development, acceptance, and production environments. Its CI/CD pattern treats database branches like code: long-lived environments branch directly from production, each pull request receives an ephemeral production-shaped branch, migrations are replayed, and a staging app image runs the full test suite against it. This topology makes periodic resets cheap, avoids deleting dependent branches, and preserves fresh test data; the team chose stacked promotion for velocity, retaining a separate crisis pipeline for urgent fixes.


### [Coding Agent Horror Stories: The Agent That Deleted Production](https://yomu.fyi/post/coding-agent-horror-stories-the-agent-that-deleted-production.md)
- Company: [Docker](https://yomu.fyi/company/docker.md)
- Author: Jennifer Kohl
- Published: Jul 20, 2026
- Type: Announcement

Recent industry updates focus on AI agent security, container maintenance, and developer workflows within Docker ecosystems. The OpenAI and Hugging Face incident involved 17,600 attacker actions, demonstrating that AI agent security requires automated system controls to constrain, observe, and govern agents rather than relying on human review. In software maintenance, Docker Extended Lifecycle Support (ELS) addresses escalating supply-chain risks and MinIO end of life by maintaining patches, building software from source, and enforcing local developer policies. For continuous integration, Docker Sandboxes enable isolated AI agents to run Testcontainers tests, implement code fixes, and submit draft pull requests within GitHub Actions. Additionally, Docker Verified Publisher applications have transitioned to a self-serve process accessible directly through Docker Hub.


### [How To Set Up a Staging Environment on Heroku in 3 Easy Steps](https://yomu.fyi/post/how-to-set-up-a-staging-environment-on-heroku-in-3-easy-steps.md)
- Company: [Heroku](https://yomu.fyi/company/heroku.md)
- Author: Andy Smith
- Published: Jul 16, 2026
- Type: Tutorial

The guide explains how to add a Heroku staging environment so changes are tested in a near-identical, isolated replica before production. It uses a pipeline with production and staging apps, disables production automatic deployments, connects staging to GitHub, and enables automatic builds, with Review Apps offered for pull requests. The setup applies Twelve-Factor practices by separating config vars and databases, recommending migrations into a fresh Postgres database or warning that pg:copy overwrites staging data and can create compliance risks. After validation, slug promotion sends the exact compiled staging asset to production without recompiling, while numbered releases support rollback; database changes must still be reversed separately.


### [Building scalable AI agents with modular prompt transpilation](https://yomu.fyi/post/building-scalable-ai-agents-with-modular-prompt-transpilation.md)
- Company: [Google](https://yomu.fyi/company/google.md)
- Author: Simerus Mahesh
- Published: Jul 16, 2026
- Type: Problem & solution

Monolithic system prompts become difficult to reason about, test, and change as teams add safety policies, domain rules, formatting requirements, and escalation behaviors. The proposed approach treats prompts as software artifacts: modular skill files are composed with includes, variables, and macros, then transpiled into deterministic artifacts. Build-time validation checks missing imports, undefined variables, and circular dependencies, while dependency graphs and CI/CD golden-file comparisons catch drift before deployment. At runtime, progressive disclosure keeps a stable control plane loaded while agents retrieve task-specific skills, reducing context exhaustion and noise. Agents can propose new skill modules or import changes through pull requests, but human review and evaluation remain part of the merge process.


### [Shipyard: How We Built Slack’s Next-Generation EC2 Platform](https://yomu.fyi/post/shipyard-how-we-built-slack-s-next-generation-ec2-platform.md)
- Company: [Slack](https://yomu.fyi/company/slack.md)
- Author: Archie Gunasekara
- Published: Jul 14, 2026
- Type: Problem & solution

Slack developed Shipyard to modernize its EC2 infrastructure by replacing continuously updated, mutable instances with immutable deployable artifacts. The platform adopts a layered image architecture starting with a standardized base image called slack-zero, which is built using AWS Image Builder and consumed by downstream service-specific machine images. Rather than running periodic Chef jobs in the background, configuration management is restricted to image baking and initial instance provisioning phases. Fleet management is handled through the Peekaboo inventory system, metric-driven progressive rollouts via Gondola, and automated instance rotation managed by a lifecycle component known as the Reaper. Developers validate cookbook updates prior to merging using Ship Quick, which provisions real infrastructure across dedicated worker fleets to verify provisioning workflows.


### [Scaling Android CI: From 44 → 10 minutes — A Deep Dive into Build Time Optimization and Best…](https://yomu.fyi/post/scaling-android-ci-from-44-10-minutes-a-deep-dive-into-build-time-opti.md)
- Company: [Swiggy](https://yomu.fyi/company/swiggy.md)
- Author: Pratik Sahu
- Published: Jul 10, 2026
- Type: Problem & solution

An Android monorepo’s CI pipeline averaged about 35 minutes in its build phase, with a P90 of roughly 44 minutes, as repeated dependency downloads, environment-driven invalidations, variant bloat, and machine limits increased work. The team reworked caching with branch- and architecture-aware keys, release/develop fallbacks, cached SDK and dependency data, and a Gradle Remote Cache, while filtering repositories and restricting CI to required variants. It also tuned 32GB runners to a 16GB heap and 12GB Metaspace, disabled configuration-cache saves in ephemeral CI, upgraded Kotlin, AGP 8.10.1, and Gradle 8.11.1, and moved critical workflows to Apple Silicon. Gradle tasks fell from 3399 to 2745, while remote-cache hit rates reached P50 44% and P90 56%. After the Apple Silicon refresh, total CI time reached P50 10 and P90 11 minutes, average credits per build dropped from 55 to 43, and a comparable rollout window saved about 5800 credits.


### [Automating cross-repo documentation with GitHub Agentic Workflows](https://yomu.fyi/post/automating-cross-repo-documentation-with-github-agentic-workflows.md)
- Company: [Github](https://yomu.fyi/company/github.md)
- Author: David Pine
- Published: Jul 8, 2026
- Type: Problem & solution

Maintaining documentation across separate repositories often leads to severe lag because technical writers must reverse-engineer shipped features weeks after release. To address this in the Aspire project, the team implemented an automated pipeline using GitHub Agentic Workflows to bridge the product and documentation repositories. When product pull requests merge, a bash step maps milestones to docs release branches before an LLM agent evaluates the diff, drafts documentation updates, and emits structured pull request intents. A dedicated safe-outputs handler materializes these drafts via a scoped GitHub App and assigns the original code reviewers to verify accuracy. Across 396 product pull requests, the system generated 82 documentation pull requests that all merged with a median turnaround time of 44.8 hours.


### [Shipping huggingface\_hub every week with AI, open tools, and a human in the loop](https://yomu.fyi/post/shipping-huggingface-hub-every-week-with-ai-open-tools-and-a-human-in.md)
- Company: [Hugging Face](https://yomu.fyi/company/hugging-face.md)
- Author: Lucain Pouget, Célina Hanouti
- Published: Jun 23, 2026
- Type: Problem & solution

huggingface\_hub, the Python client underlying libraries such as transformers, datasets, diffusers, and sentence-transformers, moved from releases every four to six weeks to a weekly cadence. A single manually triggered GitHub Actions workflow now computes versions, manages branches, tags and publishes both huggingface\_hub and the hf CLI, creates downstream RC test branches, and handles post-release tasks. An open-weights model drafts structured release notes and Slack announcements using PR metadata and documentation diffs, while OpenCode, HF Inference Providers, PyPI Trusted Publishing, and pinned, checksum-verified tooling provide the stack. Deterministic manifest validation checks missing or extra PR references, then a human reviews and publishes the drafts. The reported result is weekly shipping at about $0.25 per full release, with more consistent notes, earlier downstream breakage detection, and shorter contributor feedback loops.


### [DataOps Strategy for Modern Data Engineering](https://yomu.fyi/post/dataops-strategy-for-modern-data-engineering.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Databricks Staff
- Published: Jun 22, 2026
- Type: Explainer

DataOps is presented as a collaborative practice that applies DevOps principles—continuous integration, automated testing, and rapid delivery—to the full data lifecycle, from ingestion and transformation through trusted data-product delivery. It treats data as a continuously delivered product, with technical and non-technical participants sharing an operational cadence to improve quality and shorten time-to-insight. The recommended operating model standardizes source onboarding, enforces schemas at ingestion, uses idempotent jobs, version-controls transformations, and promotes them through tested staging and production environments, with the Bronze, Silver, and Gold layers serving as quality gates. Automated unit, data-contract, and regression tests, alongside observability, anomaly detection, SLAs, lineage, and documented rollback procedures, support reliable delivery and faster incident diagnosis. Organizations with mature DataOps practices report up to 99% fewer data-downtime incidents and 30–50% less reactive maintenance.


### [Scaling out Distroless adoption With AI](https://yomu.fyi/post/scaling-out-distroless-adoption-with-ai.md)
- Company: [Grab](https://yomu.fyi/company/grab.md)
- Author: Jia Yee Chong
- Published: Jun 22, 2026
- Type: Problem & solution

Grab is migrating from heavy base images to Distroless images to reduce security risks, despite runtime failures caused by missing shared objects, utilities, or expected directory structures. Its medium tests run services in Docker, leave internal dependencies unmocked through Testcontainers, mock external dependencies with a network proxy, and execute in CI to catch Dockerfile regressions before deployment. For services without this setup, an agentic workflow detects candidates, scaffolds tests, fixes repository-specific failures, raises GitLab merge requests, and monitors CI while processing batches in parallel. Claude Code uses MCP integrations for GitLab, Glean, and Sourcegraph, with guardrails limiting changes to test files and CI configuration and humans reviewing every draft merge request. In roughly 1.5 months, the agent raised more than 100 medium-test merge requests and reduced work for 400 services from 400–1,200 engineer-days to approximately 0.1 days per service; Distroless adoption also grew substantially.


### [Data Pipeline Best Practices: Architecture, Modern Pipelines, and Deployment](https://yomu.fyi/post/data-pipeline-best-practices-architecture-modern-pipelines-and-deploym.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Databricks Staff
- Published: Jun 18, 2026
- Type: Tutorial

Modern data pipelines move raw data from source systems through transformation and storage to downstream consumers, with batch, streaming, or hybrid operation selected according to latency needs. The guidance places service-level agreements first, defining acceptable latency, uptime, and error rates before architecture choices, and compares ETL, ELT, and zero-ETL patterns. It recommends immutable raw landing zones, CDC for transactional sources, schema registries, event replay, incremental loads, and idempotent writes using techniques such as MERGE operations. Performance and reliability practices include partitioning, clustering, data-quality checks, observability, automated CI/CD testing, and cost controls such as autoscaling and storage tiering. Adoption guidance advises piloting a representative pipeline, measuring telemetry and cost, then iterating through regular architecture reviews.


### [Catch visual regressions with Snapshots, now in beta](https://yomu.fyi/post/catch-visual-regressions-with-snapshots-now-in-beta.md)
- Company: [Sentry](https://yomu.fyi/company/sentry.md)
- Author: Max Topolsky
- Published: Jun 11, 2026
- Type: Announcement

Sentry has released the beta version of Sentry Snapshots to catch visual regressions on pull requests across any platform with a frontend. The tool captures screenshots of an application across various viewports, themes, and languages, compares them against a baseline, and blocks pull requests when diffs are detected. Teams can attach custom context metadata, including test file paths, to help developers and AI agents locate test sources and generate additional test cases. By leveraging the sentry-mcp integration, REST API, and sentry-cli, workflows can retrieve base images, diff masks, and run local diff verification before pushing commits. Originally created at Emerge Tools for mobile applications, this iteration expands automated visual testing capabilities to broader frontend codebases.


### [Migrating Your GitHub CI to Hugging Face Jobs](https://yomu.fyi/post/migrating-your-github-ci-to-hugging-face-jobs.md)
- Company: [Hugging Face](https://yomu.fyi/company/hugging-face.md)
- Author: Abubakar Abid
- Published: Jun 9, 2026
- Type: Tutorial

Trackio's GitHub Actions CI was limited by generic hosted machines, maintenance-related delays, and lack of readily available GPU runners, while the project needed CPU checks and CUDA-based tests. The setup keeps GitHub Actions as the CI coordinator and uses a dispatcher Space plus the huggingface/jobs-actions bridge to launch ephemeral GitHub runners inside Hugging Face Jobs, selected through labels such as hf-jobs-cpu-upgrade and hf-jobs-t4-small. The guide covers duplicating and configuring the dispatcher, creating a GitHub App, supplying runner credentials and an HF token, changing runs-on, choosing Docker images, and validating runs and logs; Playwright and NVIDIA CUDA images are used for CPU and GPU examples. In Trackio, the CPU job took 1m10s versus a 1m40s GitHub ubuntu-latest baseline, while the GPU check passed in 45s and cost less than a cent at the t4-small rate; logs were available through both systems.


### [Enabling Evolutionary Database Development: database branching with Lakebase, continued](https://yomu.fyi/post/enabling-evolutionary-database-development-database-branching-with-lak-2.md)
- Company: [Databricks](https://yomu.fyi/company/databricks.md)
- Author: Pramod Sadalage, Kevin Hartman
- Published: Jun 5, 2026
- Type: Explainer

This installment revisits Evolutionary Database Design and argues that Databricks Lakebase removes the infrastructure constraints that kept several of its database-change practices aspirational. Lakebase is a managed Postgres database with compute separated from shared durable storage, while copy-on-write branches create a new pointer and divergence marker in roughly one second without copying parent data. That enables per-developer, per-PR, and per-experiment databases, real Postgres test branches instead of mocks or in-memory substitutes, and CI isolation at pull-request granularity. The updated playbook adds idempotent migrations, destructive testing, and database-level A/B prototyping, with Unity Catalog governance inherited by branches and agents receiving branches rather than production access. Jen’s example corrupts production-shaped data to test an inventory-code migration and compares column and lookup-table designs, rejecting the latter because its common read path requires a join.


[Newer posts](https://yomu.fyi/topic/ci-cd/page/2.md) · [Older posts](https://yomu.fyi/topic/ci-cd/page/4.md)