Reducing Renovate's blast radius: split groups, custom managers, and the temporal-polyfill lesson
A single broken dependency blocked 20 updates in one Renovate PR. Three config changes prevent it from happening again.
Blog
10⁻¹X Engineer stuff.
Immutable release bundles and SSM deploys on EC2 without a container orchestrator
Running a production backend on EC2 without Kubernetes: the immutable-release and coherent-backup model I put in to make deploys reversible and restores internally consistent.
GitLab CI auto_cancel can silently drop pipelines after MR rebase
When auto_cancel: on_new_commit is configured, rebasing a merge request from the GitLab web UI can prevent the new pipeline from spawning entirely.
ALTER TYPE ADD VALUE requires the type owner
Adding a value to a PostgreSQL enum requires owning the type itself, and a pg_class ownership-transfer loop won't reassign enums because standalone types live in pg_type.
A Cognito token-pair contract: API Gateway authorizer, Spring, Hono, and PowerSync
How one Cognito user pool serves four client surfaces through a shared token-pair contract, a REQUEST Lambda authorizer, and defense-in-depth re-validation that isolates a new mobile client without duplicating identity.
Self-hosting Renovate on GitLab CI
Running Renovate as a scheduled GitLab CI job instead of the hosted GitHub App: the execution model, the token strategy, config validation in CI, and the tradeoffs accepted at each step.
Designing a GitLab CI cache strategy for a polyglot monorepo on a self-hosted runner
Five cache mechanisms layered on a single self-hosted GitLab runner to keep a Java + Node + Python + React Native monorepo fast without standing up an external cache service.
Collapsing GitLab CI rules instead of the control-plane pattern
GitLab's recommended control-plane include looked like the clean fix for ~40 repeated rules blocks. I evaluated it, found it would break my manual fallbacks and my lint tool, and collapsed the duplicated if-blocks in place instead.
Why pnpm-lock.yaml belongs in .prettierignore
Renovate PRs fail CI when Prettier reformats the lockfile. The fix is one line.
Six ways a full root pnpm workspace broke my polyglot monorepo
Pulling four mature JS apps into one root pnpm workspace with a shared lockfile failed for six concrete reasons; here's the narrower shape that survived.
Scoping a GitLab CI monorepo pipeline by what actually changed
A lockfile change rebuilt five unrelated jobs. The fix was to stop using the lockfile as a build trigger and let the cache key encode toolchain changes instead.
pnpm audit signatures: a 'terminated' reason is a network error, not tampering
When pnpm audit signatures flags a package as invalid with reason 'terminated', the packument HTTP fetch failed, not a signature failure or tampering.
Codifying a pnpm audit remediation SOP into an agent skill
After re-deriving the same pnpm audit remediation decision tree across five JS trees one too many times, I packaged it as an agent skill that runs the process instead of rediscovering it.
A gitignore re-include that never shipped broke my Tauri CI build
A Tauri resource glob hard-failed on CI with exit code 101 because a gitignore !KEEP re-include pointed at a file that was never committed, leaving the resources dir empty on fresh checkouts.
Gondolin sandboxing for AI coding agents: two tiers from tool-only to full clean room
A two-command setup that runs the pi coding agent with either tool-only filesystem sandboxing or full clean-room isolation, each tier matching a different threat model.