Where to put git worktrees when you have many repos
Comparing three git worktree layouts for many local repos, and why I settled on ~/worktrees/<repo>/<slug>.
Developmentgitworktreesworkflow
How I split a shared Bash and Zsh configuration without changing startup behavior
I reorganized a shared shell configuration into XDG-aligned domain modules while preserving startup order, behavior, and warm-shell performance.
DevelopmentshellbashzshBuilding an fzf Git worktree switcher for Bash and Zsh
I built a shell-native Git worktree selector with safe removal, optional pull-request previews, and behavior shared by Bash and Zsh.
DevelopmentgitworktreesfzfWhy pnpm audit --fix=update kept a vulnerable nanoid behind an auto-installed peer
A pnpm peer-resolution path dropped the update depth, retained nanoid 3.3.16, and made a full lockfile and node_modules refresh the clean no-override fix.
Developmentpnpmsupply-chaindependency-managementHow pnpm deploy --legacy left dangling workspace symlinks in our Docker image
Starting with pnpm 11.19 in our build, `pnpm deploy --legacy` left workspace dependencies linked to source directories that the runtime image did not contain.
DevelopmentpnpmdockermonorepoWhy Kitty's SSH kitten fails in multi-client zmx sessions
zmx preserves one Kitty window ID and broadcasts the SSH kitten handshake to every attached client, causing rejected or interleaved responses.
DevelopmentkittyzmxsshDagger in a GitLab CI pipeline: assessment
I evaluated Dagger against a monorepo running 2,000 CI jobs a month, separating pipeline changes from the runner, cache, and hardware constraints that remain.
Developmentdaggergitlabci-cdPMD's ExceptionAsFlowControl flagged a throw that was never caught
A PMD violation appeared on a clean checkout because the pmd task lacked compiled classes for type resolution. The review also exposed an HTTP contract change behind a passing gate.
Developmentpmdjavastatic-analysisMoving a React Native 0.86 app to Expo CNG and fixing its Java 17 release path
How I migrated an Android Expo app from a committed native project to reproducible CNG, then fixed the release task that still inherited the wrong JDK.
Developmentexporeact-nativeandroidWhy I switched to zmx for terminal session persistence
zmx gives me the one thing I actually used from tmux (detachable sessions) and leaves window management to my OS, terminal, and editor.
DevelopmentzmxtmuxterminalComparing a used Mac Mini, ARM64 hardware, and AMD x86 for GitLab CI
A comparison of a used M1/M2 Mac Mini, ARM64 servers, and AMD x86 hardware for a GitLab CI runner with x86_64 production images.
Developmentarm64amdmac-minimise lockfiles: why locked=true needs lockfile=true
A missing lockfile setting left mise warning about unresolved tools; the CI lock check also depended on generating locks on glibc rather than musl.
DevelopmentmisecirenovateHow I measured our local GitLab runner usage against GitLab.com compute minutes
Using glab and the GitLab API to turn a self-hosted runner's job durations into GitLab.com SaaS compute-minute estimates.
Developmentgitlabci-cdrunnersSeven ways to host a GitLab CI runner in 2026, priced and compared
A comparison of home hardware, GitLab.com, AWS, ARM64 cloud, local AMD hardware, and Hetzner for a monorepo running 2,000 CI jobs a month.
Developmentgitlabci-cdrunnersRemoving the brace-expansion patch after moving minimatch to v10
A recurring SyntaxError traced to a brace-expansion patch and an ESM export-shape mismatch: how moving minimatch to v10 removed one patch while a minimatch@3 compatibility patch remained necessary.
Developmentpnpmrenovatedependency-managementClearing thirty Renovate merge requests in one pass
A retrospective of clearing a 30+ MR dependency backlog in a repository with JavaScript, Java, Python, and Terraform projects, including CI, supply-chain, and typecheck changes.
Developmentrenovategitlab-cidependency-managementTty-aware shell wrappers for OSC 8 hyperlinks in eza, ripgrep, and fd
Shell functions that add OSC 8 hyperlink flags to eza, ripgrep, and fd only when stdout is a terminal, so clickable paths never leak into pipes or files.
DevelopmentshellezaripgrepWhat Changed in pnpm Since 11.7 Until 11.13.1
Seven pnpm releases shipped between 11.7 and 11.13.1, and the one that maps to my config is a peak-memory fix for the minimumReleaseAge and trustPolicy resolution path.
Developmentpnpmsupply-chainsecurityAWS auth in a Gondolin VM: why SigV4 breaks the secrets bridge
The Gondolin bridge substitutes placeholders in request headers, but the AWS SDK signs the request over the placeholder value. The substitution happens too late and every call returns SignatureDoesNotMatch. The fix is to mount the host's ~/.aws/ read-only instead.
Developmentgondolinawssigv4Why Lychee checked 336 links in CI and 6,633 locally
An unquoted recursive glob made Lychee scan seven shallow HTML files in GitHub Actions while the quoted local command reached the full generated Astro site.
Developmentlycheecigithub-actionsDependency caching belongs at the registry layer, not the package store
Caching the package manager store treats a symptom. A pull-through proxy registry is the layer where cross-runner dependency caching actually compounds.
Developmentcachingnexusplatform-engineering_EXPERIMENTAL_DAGGER_CACHE_CONFIG is inert in Dagger 0.21
A source trace explains why Dagger's BuildKit cache bridge works on 0.20.1, disappears in 0.21, and leaves type=gha with no effect.
DevelopmentdaggercachingbuildkitPractical cache strategies for ephemeral Dagger CI
A decision guide to persistent engines, host-side cache bridges, registry proxies, and cold execution after Dagger 0.21 removed BuildKit remote export.
DevelopmentdaggercachingciTypeScript 7 is fast, but the Compiler API is gone. Here is what that breaks.
The Go rewrite delivers 10x faster type-checking. It also removes the programmatic API that eslint, Dagger, and every framework template type-checker depends on.
DevelopmenttypescripteslintdaggerShipping visual regression on React Native: Maestro baselines, an RNTL v14 migration, and killing Storybook
How I closed two testing gaps on a React Native/Expo app, visual regression and CI integration, by adding Maestro baselines, migrating RNTL to v14, and deleting Storybook RN entirely.
Developmentreact-nativemaestrotestingReducing Renovate's blast radius: split groups, custom managers, and the temporal-polyfill lesson
A single broken dependency blocked 20 updates in one Renovate PR. Three config changes prevent it from happening again.
Developmentrenovatepnpmsupply-chainImmutable release bundles and SSM deploys on EC2 without a container orchestrator
Running a production backend on EC2 without Kubernetes: the immutable-release and coherent-backup model I put in to make deploys reversible and restores internally consistent.
Developmentawsec2ssmA Cognito token-pair contract: API Gateway authorizer, Spring, Hono, and PowerSync
How one Cognito user pool serves four client surfaces through a shared token-pair contract, a REQUEST Lambda authorizer, and defense-in-depth re-validation that isolates a new mobile client without duplicating identity.
DevelopmentawscognitosecuritySelf-hosting Renovate on GitLab CI
Running Renovate as a scheduled GitLab CI job instead of the hosted GitHub App: the execution model, the token strategy, config validation in CI, and the tradeoffs accepted at each step.
Developmentsecuritysupply-chainrenovateDesigning a GitLab CI cache strategy for a polyglot monorepo on a self-hosted runner
Five cache mechanisms layered on a single self-hosted GitLab runner to keep a Java + Node + Python + React Native monorepo fast without standing up an external cache service.
DevelopmentgitlabcicachingCollapsing GitLab CI rules instead of the control-plane pattern
GitLab's recommended control-plane include looked like the clean fix for ~40 repeated rules blocks. I evaluated it, found it would break my manual fallbacks and my lint tool, and collapsed the duplicated if-blocks in place instead.
DevelopmentcigitlabmonorepoSix ways a full root pnpm workspace broke my polyglot monorepo
Pulling four mature JS apps into one root pnpm workspace with a shared lockfile failed for six concrete reasons; here's the narrower shape that survived.
DevelopmentpnpmmonorepomigrationScoping a GitLab CI monorepo pipeline by what actually changed
A lockfile change rebuilt five unrelated jobs. The fix was to stop using the lockfile as a build trigger and let the cache key encode toolchain changes instead.
DevelopmentcigitlabmonorepoCodifying a pnpm audit remediation SOP into an agent skill
After re-deriving the same pnpm audit remediation decision tree across five JS trees one too many times, I packaged it as an agent skill that runs the process instead of rediscovering it.
Developmentpnpmsupply-chainagentsA gitignore re-include that never shipped broke my Tauri CI build
A Tauri resource glob hard-failed on CI with exit code 101 because a gitignore !KEEP re-include pointed at a file that was never committed, leaving the resources dir empty on fresh checkouts.
DevelopmenttaurigitciGondolin sandboxing for AI coding agents: two tiers from tool-only to full clean room
A two-command setup that runs the pi coding agent with either tool-only filesystem sandboxing or full clean-room isolation, each tier matching a different threat model.
Developmentpigondolinsecuritypi crashed inside the Gondolin sandbox: the Bun vs Node runtime mismatch
A Gondolin-sandboxed pi session crashed on socket close because mise ships pi as a Bun binary while the Gondolin SDK targets Node; installing pi via npm under mise-managed Node fixed it.
DevelopmentpibunnodeProton Pass CLI: Replacing Shell-Wide Secret Exports with Process-Isolated Injection
How I moved API key exports from eager shell startup to lazy, process-isolated injection using pass-cli run.
Developmentproton-passsecurityshellBuilding and maintaining a Uruky web search skill
How an agents.md skill wraps Uruky, a privacy-first paid search engine, for coding agent use, with provider selection, JSON output, and a recent login-flow fix.
DevelopmenturukyskillsdebuggingClosing Renovate's transitive-CVE blind spot
Renovate's vulnerability alerts only cover direct dependencies in npm and pip. Here is the CI-gate and manual-remediation pattern that catches the rest, and why I run Renovate without Dependabot.
Developmentsecuritysupply-chainrenovateScoping nvim-jdtls to a Maven subproject in a polyglot LazyVim setup
How a root_dir callback gate scopes jdtls to a Maven backend in a polyglot pnpm monorepo on Neovim 0.12.
Developmentneovimneovim-0-12lazyvimSelf-Contained mise in Dagger: Eliminating Tool Version Drift
Committing a self-contained mise bootstrap, mounting persistent cache volumes in Dagger, and enforcing the lockfile everywhere so mise.toml is the only source of truth for the toolchain.
DevelopmentmisedaggerciUnifying a pnpm Monorepo's Dependency Versions with Catalog
Using pnpm catalog to turn two workspace packages with divergent TypeScript and ESLint versions into a single source of truth. Covers a Remotion peer-dep fix and a minimumReleaseAge interaction.
Developmentpnpmmonorepodependency-managementWhat Changed in pnpm Since 11.1.2 Until 11.7.0
Six pnpm releases shipped while my project was frozen at 11.1.2. Two of them added security controls I should have adopted sooner.
Developmentpnpmsupply-chainsecurityAdding Dagger CI to a Polyglot Monorepo
Porting my Dagger module to a repo with a uv Python service and pnpm frontends broke the lockfile-first cache trick, because uv builds the project at install time and pnpm does not.
DevelopmentdaggercipythonPython's Build System with uv
The frontend/backend split, the wheel pipeline, and why uv sync builds your project.
DevelopmentpythonuvpackagingAdding Dagger CI to an Astro Blog
One container, ten checks, local/CI parity, and three bugs that taught me how Dagger works.
DevelopmentdaggerciastroFixing zizmor findings without suppressions
Three fix patterns for common zizmor findings: creating environments via gh api, hardening git auth with remote set-url, and replacing third-party actions with native commands.
Developmentzizmorsecuritysupply-chainBuilding a 64-Layer ZMK Glove80 Layout
How I widened ZMK's layer state from 32-bit to 64-bit and built a dual-OS keyboard layout for the Glove80.
Developmentzmkglove80claude-codeUpgrading Payload CMS 3.85.0: from 12 audit vulns to zero
A systematic approach to eliminate every known vulnerability and replace pnpm monkey-patches with proper supply-chain configuration.
Developmentpayload-cmspnpmsupply-chainWhy I use two different file pickers in Neovim
fff.nvim is fast and frecency-aware but opinionated about git repos. Snacks.picker covers what fff skips: dotfiles, non-git directories, everything. I wired both into the LazyVim dashboard.
DevelopmentneovimlazyvimfffEarly look at Astro 7 alpha with Vite 8 and Rolldown
Updating this blog to Astro 7 alpha surfaced vite version conflicts, rolldown type incompatibilities, and the fact that pnpm update bypasses minimumReleaseAge.
DevelopmentastroviterolldownFixing white borders on Apple touch icons
How transparent PNGs cause white borders on Apple devices and the fix.
DevelopmenticonsiospwaHardening a Renovate Config for Supply Chain Security
Closing supply chain gaps in an existing Renovate setup with OSV scanning, SHA pin protection, and cooldown alignment complementing pnpm's minimumReleaseAge.
Developmentsecuritysupply-chainrenovateOpening terminal paths in an existing Neovim pane with Kitty hyperlinks
How I wired kitty, OSC 8 hyperlinks, and Neovim remote control so plain clicks on ls and rg output open files in the nvim pane already running in the same window.
DevelopmentkittyneovimterminalShort git hunk previews and CodeDiff in LazyVim
How I replaced diffview with CodeDiff and wired gh and ]h for wrapped gitsigns hunk previews in LazyVim.
DevelopmentneovimlazyvimgitsignsAutomated Dependency Updates with Supply Chain Security
How to set up Renovate or Dependabot with cooldown policies that complement pnpm's minimumReleaseAge: automated patches without opening the door to compromised packages.
Developmentsecuritysupply-chainrenovateBeyond Version Checks: Provenance and Behavioral Security
Lockfiles, cooldowns, and exclusion lists are necessary but not sufficient. Provenance verification and behavioral analysis catch the attacks they miss.
Developmentsecuritysupply-chainprovenanceKeeping Supply Chain Exclusions Honest
Your pnpm security config decays over time. minimumReleaseAgeExclude entries pile up, trustPolicyExclude entries become stale, and allowBuilds lists drift from reality. Here's how to catch it.
Developmentsecuritysupply-chainpnpmReplacing My Custom Pagefind Modal with astro-pagefind
How the astro-pagefind integration replaced three Vite workarounds with a single dependency.
DevelopmentastropagefindsearchPagefind in Astro: The Gotchas I Hit
Three issues I ran into integrating Pagefind search into an Astro site with Vite's bundler.
DevelopmentastropagefindsearchMigrating from Nuxt Content to Astro Content
What changed when I replaced Nuxt Content's schema and collections with Astro's content collections.
Developmentnuxtastrocontent-collectionsSupply Chain Security with mise and pnpm
Trying to survive in the JS minefield
Developmentsecuritysupply-chainmiseCreating a Tone Skill for AI-Assisted Blog Posts
How I turned implicit writing patterns into a reusable agent skill for consistent Clanker-authored content.
DevelopmentagentsskillswritingSEO Audit of Two Astro Projects
What I found when I reviewed the Open Graph and structured data setup across bsnews and frangonf.com, and what I changed.
Developmentastroseoopen-graphImage Optimization in Astro
Replacing raw img tags with Astro's built-in Image component for automatic optimization, responsive srcsets, and format conversion.
Developmentastroimage-optimizationweb-performanceAdding Accessibility Testing to My Astro Site
How I added axe-core and knip to catch accessibility issues, and fixed a contrast problem hiding in my CSS variables.
Developmentaccessibilityastrotesting