Loading…
Topic
151 posts about CI/CD. Every summary links to the original.
See the idea
A five-step workflow for turning agent output into versioned artifacts: scope a repo per agent, branch instead of copying, run in an isolated sandbox, gate changes with push-triggered evals, then deploy or roll back.
Buildkite splits CI into a hosted control plane and agents you run on your own machines. This comparison weighs that self-hosted agent model against fully hosted runners so you can pick the right fleet.
Anka is a Docker-like macOS virtualization layer for disposable CI environments. This architecture shows how images, Mac hosts, snapshots, build agents, and artifacts connect.
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Dropbox reduced its core server monorepo size from 87GB to 20GB after approaching GitHub's 100GB limit and suffering from hour-long clone times. The excessive bloat was traced to Git's delta compression heuristics interacting poorly with internationalization directory paths, generating inefficient diffs across different languages. By collaborating with GitHub to run an aggressive server-side repack with tuned window and depth settings, Dropbox cut clone times to under 15 minutes.
Cursor now supports plugins, allowing agents to connect to external tools and acquire new knowledge. Plugins bundle MCP servers, skills, subagents, rules, and hooks to add custom functionality. The initial curated set includes Amplitude, AWS, Figma, Linear, Stripe, Cloudflare, Vercel, Databricks, Snowflake, and Hex, covering planning, design, payments, infrastructure, data, and analytics workflows. Users can install prebuilt plugins from the Cursor Marketplace or create and share their own, while plugin primitives let agents discover domain-specific skills, run subagents in parallel, connect through MCP servers, observe behavior with hooks, and follow rules. The announcement also introduces the Cursor Team Kit for internal CI, code review, and testing workflows, and says private team marketplaces with governance and security controls are coming.
Stripe’s Minions are homegrown, fully unattended coding agents designed to complete tasks in a single run, beginning with an invocation such as a Slack thread and ending with a pull request ready for human review. More than 1,000 pull requests merged weekly at Stripe are minion-produced and contain no human-written code, although engineers review them and can provide follow-up instructions. Each run uses an isolated, pre-warmed devbox and a customized fork of Block’s coding agent goose, combining agent loops with deterministic operations for version control, linting, and testing. Minions use curated MCP tools, including Stripe’s Toolshed with more than 400 tools, to retrieve internal context before and during work. Local checks and selective CI provide feedback, with no more than two CI rounds, balancing correction against token, compute, and time costs.
The post addresses the difficulty of using AI agents to configure Stripe resources when one-off API calls leave no durable source of truth for state, changes, or environment differences. It recommends using agents to author Terraform configuration rather than operating Stripe directly, so products, prices, and webhook endpoints become explicit, reviewable code. The example defines a Standard Plan with $20 monthly and $200 annual prices, selected webhook events, and outputs for both price IDs, then applies it with terraform plan and terraform apply. Terraform provides declarative, repeatable configuration supported by Git history, pull-request review, and environment-specific workspaces. Separate sandbox and livemode workspaces, paired with matching STRIPE_API_KEY values, are presented as a way to reduce accidental cross-environment changes.
Scaling research and trading platforms across thousands of data sources created bottlenecks at Two Sigma, where reliance on database snapshots and fragmented infrastructure slowed dataset delivery to data scientists. To address operational costs and architectural complexity, the data engineering team adopted software development principles by treating data as code. The organization migrated to Google BigQuery's serverless architecture, standardized SQL transformations using dbt, and defined declarative pipelines with Terraform under continuous integration workflows. Internal tooling was introduced to track directed acyclic graph dependencies, automate anomaly detection, and streamline data discovery. These shifts eliminated manual data movement routines, reduced operational overhead, and enabled formal data contracts to safeguard downstream consumers and emerging language model integrations.
Grab moved its macOS CI/CD infrastructure from a US cloud vendor to a colocation cluster in Malaysia, closer to its Git servers in Southeast Asia. The change followed growth from one office Mac Pro to more than 250 Mac minis, rising demand, job queues, and cloud costs that made ownership or colocation more attractive at scale. Grab selected bare-metal hardware after comparing cloud, colocation, and on-premises options, then migrated progressively while monitoring failure rates, performance, and reliability; the later infrastructure also uses zero-touch provisioning to reduce manual setup as the cluster grows. The migration produced projected savings of more than $2.4 million over three years and performance improvements of 20–40%, while the team chose allocated-kilowatt power commitments and retained bare metal because macOS virtualization’s performance or stability trade-offs did not justify it.
Software becomes valuable only when it reaches customers, because deployment starts the feedback loop that tests assumptions and enables the next improvement. The post argues that although software deployment can now take seconds or minutes, teams often retain habits from an era of infrequent, costly releases, making shipping itself a source of risk and delay. It uses time to production (TTP) as a technical and organizational lens: a one-minute fix can be tested, reviewed, merged, deployed, and communicated immediately, while hours, days, or weeks encourage waiting, batching, deploy windows, larger releases, and growing bug backlogs. Continuous shipping is presented as a company-wide practice that improves feedback, decision-making, customer responsiveness, momentum, motivation, and hiring, while requiring ongoing effort to reduce TTP and treat shipability as a design concern.
Two Sigma structures its quantitative investment operations around foundational platforms that balance operational speed with scientific rigor. In data engineering, foundational teams provide both raw and curated datasets using BigQuery, CI/CD-managed transformation pipelines, and reusable data contracts termed ice cubes to serve ninety percent of use cases. Quantitative modeling incorporates open-source large language models trained strictly on point-in-time data to rapidly generate features while preventing temporal leakage. Long-term platform innovation follows an epsilon and omega strategy that couples overarching vision with iterative, learning-focused steps. Platform leadership categorizes artificial intelligence applications into advisory, oracle, operational, and agentic functions designed to enhance human productivity rather than replace researchers.
Hugging Face announced a collaboration with VirusTotal to enhance the security of files shared across the Hugging Face Hub. Hosting more than 2.2 million public model and dataset repositories, the platform faces potential threats from malicious payloads, compromised files, and dependencies that execute unsafe code. Starting immediately, public repositories on the Hub undergo continuous scanning powered by VirusTotal threat intelligence. When users view repository or file pages, the Hub checks file hashes against VirusTotal without transferring raw file contents, preserving user privacy. Retrieved metadata displays detection counts, clean or malicious status, and known-bad relationships, enabling organizations to evaluate risks prior to downloading assets or integrating them into deployment pipelines.
The pattern combines GitHub Actions with Heroku Flow for private repositories and stricter security requirements when GitHub organization IP restrictions cannot use Heroku IP ranges. A custom self-hosted GitHub Runner runs as a Docker image on Heroku, while the Platform API and Source Endpoint API upload source code to ephemeral storage, build and deploy apps, and manage Review Apps. Event-specific workflows handle pushes, manual runs, schedules, and pull requests; a weekly workflow rebuilds and autodeploys the runner image within GitHub’s 30-day update window. Setup uses a Heroku Private Space, its outbound IPs, a GitHub access token, and organization name, but omits the repository URL in the Review App UI, does not run conventional Heroku CI tests, and is incompatible with Fir.
This article reports practical lessons from two September 2024 JP_Stripes events in Aizuwakamatsu and Sapporo for developing and operating Stripe-integrated services more efficiently and at lower cost. Sandboxes let teams create up to five separate test environments, reproduce payment failures and state transitions through Stripe's API, and use CI-specific workspaces without production access. Stripe Connect examples show how a three-person codoc team launched in nine months by staggering account creation and embedding payout and payment-management interfaces. For fraud prevention, the article recommends Radar or Radar for Teams with webhook automation, including early-fraud-warning events and preemptive cancellation or refunds when dispute fees exceed transaction value. Together, these cases emphasize using managed Stripe capabilities and community-shared implementation experience to reduce testing effort, UI work, and fraud-related costs.
Stripe sandboxes let developers manage multiple test environments from one Stripe account for AWS-hosted applications, extending Stripe’s test mode with simulated external events, fake balances, and Test Payouts using API v2 keys. The post describes seeding a sandbox with products and other Stripe objects by exporting production data to CSV for import or generating records with the Stripe CLI and scripts. For local use, developers authenticate with stripe login, while CI scripts pass a sandbox key to each CLI request and can optionally delete the created products afterward. It recommends storing the key in AWS Secrets Manager, retrieving it at runtime through the AWS CLI or SDK, restricting access with IAM, avoiding logs and source repositories, and rotating keys; this lets CI scripts use sandbox data without exposing credentials.
The guide presents a secure CI/CD pipeline for managing Okta resources with Terraform, AWS, and GitHub Actions, addressing local setup, collaboration, state storage, secrets, and deployment automation. Its architecture uses GitHub as source control and workflow trigger, GitHub OIDC to authenticate to AWS IAM STS and assume roles, S3 for Terraform state, DynamoDB for state locking, and AWS Secrets Manager for Okta OAuth 2.0 client credentials private keys. Developers push changes to develop for an automatic development build, open a pull request to main for a production plan, and merge approved changes to trigger the production build. The workflows run Terraform init, plan, and apply as appropriate, while the guide also covers repository setup, branch organization, and troubleshooting for missed configuration in GitHub, Okta, or AWS.
The article presents a walkthrough for automating end-to-end browser tests for a React application in Heroku CI rather than relying on manual local testing. The sample app uses Jest and Puppeteer to check navigation to Puppeteer Documentation, retention of text entered into a form, and the greeting shown after submission, with headless Chrome supplied by the Chrome for Testing Heroku Buildpack. Local execution initially exposes a mismatch between the expected and received greeting, then passes after the application is fixed; a streamlined command starts the server and runs the suite. Heroku CI is configured with an app.json file containing Chrome for Testing and Node.js buildpacks, plus a test script that runs start-server-and-test and the Jest/Puppeteer tests. Pushes to the connected GitHub repository trigger the suite.
Stripe integrations can become difficult to test when an account has only one test mode, because unrelated work can interfere and sensitive configuration must remain protected. The post presents Stripe Sandboxes as separate testing areas and shows a Node.js Express application authenticating with a sandbox secret key stored in a .env environment variable. It creates payment intents through /create-payment-intent and retrieves account details through /account, then uses Jest and supertest to verify the sandbox identity, including the expected display name dev-sandbox. A GitHub Actions workflow injects STRIPE_API_KEY from repository secrets, installs dependencies, and runs tests on pushes to the main branch, while .gitignore excludes environment files. The conclusion is that isolated sandboxes and automated checks reduce test tangles and help prevent calls to the wrong environment.
Shopify built Tophat to reduce the time and friction involved in manually testing mobile pull requests, where switching branches, stashing changes, and waiting for Xcode or Android Studio builds slowed review. The macOS menu-bar application links GitHub pull requests to iOS and Android artifacts produced by CI and stored in Google Cloud Storage, allowing contributors to install builds on simulators or real devices with one click. Tophat parallelizes tasks such as downloading applications and booting devices, and its Quick Launch feature retrieves builds with up-to-date native code for React Native development. The project also addressed real-device iOS installation and signing challenges, integrated with Shipit Mobile, and provided automated setup guidance. After the latest improvements, daily usage doubled, and Tophat was later made open source.
Profile-guided optimisation (PGO) improves Go application performance by feeding production CPU profile data into subsequent compiler builds. Teams evaluated PGO across multiple Grab services, including TalariaDB and an orchestrator within the Catwalk service, using Go 1.20 and Go 1.21 builds. TalariaDB saw substantial resource savings after compiling Docker images with a 360-second pprof profile, resulting in at least a 10% drop in CPU usage, a 30% drop in memory consumption, and a 38% reduction in persistent volume usage for event ingestion queues. Conversely, testing on Catwalk showed only a 5% performance gain after adjusting the profiling duration from 59 seconds to 6 minutes, an outcome deemed insufficient to justify pipeline modifications. Broader adoption across monorepo services remains constrained until the central build process supports PGO arguments and automated profile retrieval.
Grab's self-hosted GitLab instance fell approximately 14 months behind official releases, serving thousands of engineers and monorepos reaching up to 39TB in total footprint. To address security updates and system stability, the team established a structured upgrade routine using Terraform, Packer, and Ansible across GitLab's 5,000-user reference architecture. They implemented staged deployments, upgraded stateful Gitaly nodes via in-place rotation, and resolved primary node clustering bottlenecks under Praefect. By utilizing official GitLab Upgrade Paths and parallelizing component deployments, the team caught up on 24 months of releases in 11 months and reduced release lag from 396 days down to 35 days.
Grab launched Project Bonsai to optimize the size of its Android superapp, which encompassed over four million lines of code across 1,500 modules. Because large app sizes negatively impact user acquisition on low-end devices with constrained bandwidth, the engineering team structured its optimization strategy around measurement, reduction, and containment. The team developed App Sizer, a custom CI-integrated tool that tracks binary compositions and module size contributions in Grafana. Initial reductions targeted Java and Kotlin dex files, resolving bloated transitive R classes by upgrading the Android Gradle Plugin to eliminate overly broad R8 retention rules. These initiatives achieved a 26% reduction in app download size while simultaneously decreasing overall disk footprint.
Grab’s Coban real-time data streaming team initially relied on direct Terraform merge requests for managing self-served resources like Kafka topics and CDC pipelines. This pure Infrastructure-as-Code workflow faced challenges with CI pipeline failures from manual errors, security risks from lacking access controls, and platform team review bottlenecks. To resolve this, Coban implemented a three-tier control plane comprising the Coban UI, a Go backend named Heimdall, and a Git storage and provisioner repository named Khone. Heimdall translates user form submissions into validated merge requests containing Terraform and metadata files, polling Khone's CI status and alerting users. This architecture abstracts infrastructure code behind a graphical self-service portal while preserving underlying Git auditing and automation.
The best engineering reads, once a week.
