35 posts tagged with “Best Practices”
Supply chain security in CI/CD, minus the name-dropping. What NIST SP 800-204D actually is, why SLSA level numbers changed, and the cheapest first step.
Pin GitHub Actions to SHA is near-universal advice. What it means on GitLab, why CircleCI orbs cannot be pinned at all, and what pinning still does not fix.
Auditor-ready CI/CD means producing six day-one artefacts without the pre-fieldwork scramble. What each one is, and the test of whether yours would survive.
CI/CD monitoring vs observability: monitoring answers is it broken, observability answers why and what next. The single-run boundary that separates them.
How to reduce flaky tests by changing how the team works first: branch length, a written rerun policy, named owners, and the merge bar. Tooling comes after.
Real-time CI/CD monitoring is a spectrum, not a binary: fixed polling, ETag conditional requests, and event push. What freshness each decision actually needs.
ISO 42001 AI pipeline controls cover four Annex A lifecycle controls, and only when the pipeline builds an AI system. Using Copilot does not put you in scope.
CI pipeline waste falls into five categories. How to detect each one in your own pipelines, what the fix costs, and which to tackle first.
Monitoring AI-generated code is an observability problem, not a detection one. The four CI signals that shift after an assistant rollout, and what each means.
Measuring AI coding productivity does not need new metrics. Why acceptance rate misleads, why splitting DORA by author is a trap, and which metrics move first.
DORA metrics benchmarks by tier: the Elite/High/Medium/Low thresholds per metric, why DORA retired the four tiers in 2025, and how to use them without gaming.
Flaky tests in CI/CD cost more than reruns: the pipeline gates a shared trunk and runs on trust. Why the cost scales with team size, and where flakes surface.
Reduce CI/CD costs by cutting waste, not speed. Why compute-first cuts backfire, the five waste categories to target, and why faster is usually cheaper.
CI pipeline stability is a classification, not a pass rate. The three signals that sort every test into healthy, flaky, or broken, and the thresholds to use.
CI/CD dashboard vs provider UI: the Actions tab is built for one repo and one run. Where it stops scaling for a team, and what a unified dashboard adds.
Flaky test detection at scale is reading verdict history, not rerunning everything. The strategies, the flip-rate signal, and classifying healthy, flaky, broken.
SOC 2 CI/CD evidence already lives in your pipeline: the change-management, access, and operations records, produced continuously for CC6, CC7, and CC8.
A buyer's guide to DORA metrics tools: choose on the data source they read, how they define each metric, and how the price scales, not the dashboard.
Multi-provider CI/CD monitoring sees delivery health across every CI provider at once. Why two-plus providers is the norm, what breaks per-provider, and the fix.
Measuring DORA metrics across multiple CI/CD providers is the norm. Why per-provider numbers fragment, the three things to normalise, and what you can compare.
Deployment rework rate is the fifth DORA metric, added in 2024. It catches what change failure rate misses: how much reactive deploy work failures create.
Mean time to recovery (MTTR) is only honest if the clock starts at customer impact and stops at genuine fix. The two clock traps, and how to recover faster.
Change failure rate is the one DORA metric you can't improve by shipping faster. What it counts, the one way it gets gamed, and how to bring it down.
A CI/CD audit trail an auditor can use is small, structured, and indexable. The schema to capture per change, where it already lives, and how long to keep it.
The ISO 27001 CI/CD controls auditors check, mapped to pipeline evidence: which Annex A controls a software-delivery audit touches and what proves each one.
Deployment frequency is the most intuitive DORA metric and the easiest to inflate. What counts as a deployment, and how to raise it without gaming the count.
How to fix flaky tests: six root-cause classes, the diagnostic checklist per class, and the test-strategy fix most teams skip. Telltale log signatures for each.
Lead time for changes is simple until two managers disagree. The clock-start choice, the deployment rule, and what to do when the number is too high.
CI/CD cost per build is compute plus developer wait time. The formula, real numbers from 378 GitHub Actions runs, and why the invoice undercounts by 100×.
The real cost of flaky tests is compute reruns plus developer wait time. The maths on why every flake pays twice, what we observed, and where to start.
A CI/CD pipeline audit is a practitioner's health check, not a maturity model. The framework, what to look for, and the prioritised punch list teams act on.
Developer wait time is the biggest CI cost your team never invoices. The taxonomy, a worked example, and why it beats compute by two orders of magnitude.
Don't monitor everything that can be counted. Monitor the signals that show whether your CI, deploy, recovery, and economic feedback loops are closing.
CI/CD is not a pipeline. It is the discipline of short feedback loops from commit to customer: small batches, fast tests, real deployments that ship.
A practical guide to measuring the five DORA metrics in real CI/CD pipelines, including deployment rework rate (added in 2024). Covers the decisions to settle first, the data sources to use, and the traps to avoid for each metric.