Search
Posts
One Corrected Check, Fifteen Repos
Correcting a gate is cheap. Propagating it through fifteen repos on a vendored, hash-pinned lane is the part that costs a day.
ReadScope the Guard to What the Job Actually Writes
Scope a guard to the paths its job actually writes. How a nightly producer kept aborting on edits it would never have touched.
ReadA Path Is Not Proof of Identity
A file descriptor binds you to an object. A path does not. Why a stat check plus a later write still loses to a same-UID directory swap.
ReadBind the Receipt to the Commit It Installed
An E2E test receipt that carries the installed commit hash makes provenance checkable. Six commits on one lane, three of them asserting a literal string.
ReadA Ratchet Is Only as Strong as Its Re-Baseline Rule
Pinning compliance violations in CI is the easy half. Eight iterations in one day to build a gate that refuses unauthorized baseline growth.
ReadEvery Verdict Carries the Scope It Actually Ran
A verdict covers only what it ran. Four same-day cases, including a request-forgery class closed by deleting the feature it lived in.
ReadRefusing to Classify Beats Matching Harder
A status classifier should refuse wording it cannot positively recognize. A negation guard closed one bypass in a governance view, and a hyphen walked past it.
ReadA Duplicate Is a Relation, Not a Property
Duplicate detection needs to see multiple files at once. A check inside a per-item loop can only guess.
ReadEvery Check Should Report What It Did Not Look At
A status job that always runs reports which checks executed and which are unproven, so a skipped GitHub Actions job cannot read as a pass.
ReadWhat a Skipped Check Is Worth in CI
A gate runner that counts SKIP as pass prints green for work that never ran. How a rig proof receipt closes that gap, and why filters must invert.
Read