Search
Posts
Move the deploy runner onto the tailnet, skip Tailscale OIDC
Move the GitHub Actions deploy runner onto the tailnet, skip the ephemeral Tailscale OIDC handshake. Add join-tailnet and send-revision toggles.
ReadWhen a Third-Party CI Credential Expires, the Deploy Fallback Has to Already Live on the VPS
A VPS-resident deploy script plus a SHA-pin guard turns any third-party CI credential expiry into a one-line SSH recovery.
ReadWhen git describe Traps Your CI Semver Bump, Look Up the Highest Existing Tag Instead
A bot's [skip ci] version-bump commit that was rejected by branch protection creates an annotated tag outside the branch's ancestry. git describe keeps returning the older reachable tag, the bump recomputes a version that was already tagged, and the release job fails with `tag already exists` on every push. Use `git tag --list 'v*' --sort=-v:refname | head -n1` (highest existing tag, not git describe) and the version stays monotonic forever.
ReadWhen Your Documentation Evaluation Is Driving the Cleanup, Report Gap Answers by Rank Instead of Adding Them to the Scored Set
A self-improving retrieval evaluation should not grade its own homework. Report the rank of each gap-filler doc in retrieval (answerRank per gap) and leave the fixed scored question set untouched.
ReadCoordinating a Product Launch Across Multiple Repos
The order of operations for a product launch across three repos and three releases: what each step prevents and what to check after the merge.
ReadVerify Audit Evidence with a Signed Payload, Not by Format
When eight audit-evidence publishers each emit a different format, one canonical signed payload gives one verifier a tampering signal without erasing history.
ReadSMTP 250 is not delivery: three receipts that fix transactional mail
SMTP 250 is not delivery. Three receipts fix transactional mail: a frozen ApprovedMessage, phase-classified outcomes (RFC 5321 §4.2.1), and reconciliation before any resend.
ReadFirst Slice in One Day: Eight PRs, One Sign-Off
Split a first slice into one PR per layer, capped by a governance PR with the sign-off. Each layer, the merge-guard hiccup, and the day the slice landed.
ReadPark a Refactor with Five Receipts
A parked refactor stays recoverable when it leaves five named artifacts: atomic push, draft PR, decision doc, full bundle, and a successor repo. Each is verifiable.
ReadPark a Migration Without Losing the Work
Park a migration as an atomic fast-forward to a feature branch with the full gate suite on the merged commit. Five invariants keep parked work recoverable.
Read