A PMD violation appeared on a clean checkout because the pmd task lacked compiled classes for type resolution. The review also exposed an HTTP contract change behind a passing gate.
A missing lockfile setting left mise warning about unresolved tools; the CI lock check also depended on generating locks on glibc rather than musl.
An unquoted recursive glob made Lychee scan seven shallow HTML files in GitHub Actions while the quoted local command reached the full generated Astro site.
A source trace explains why Dagger's BuildKit cache bridge works on 0.20.1, disappears in 0.21, and leaves type=gha with no effect.
A decision guide to persistent engines, host-side cache bridges, registry proxies, and cold execution after Dagger 0.21 removed BuildKit remote export.
The Go rewrite delivers 10x faster type-checking. It also removes the programmatic API that eslint, Dagger, and every framework template type-checker depends on.
When auto_cancel: on_new_commit is configured, rebasing a merge request from the GitLab web UI can prevent the new pipeline from spawning entirely.
Five cache mechanisms layered on a single self-hosted GitLab runner to keep a Java + Node + Python + React Native monorepo fast without standing up an external cache service.
GitLab's recommended control-plane include looked like the clean fix for ~40 repeated rules blocks. I evaluated it, found it would break my manual fallbacks and my lint tool, and collapsed the duplicated if-blocks in place instead.
Renovate PRs fail CI when Prettier reformats the lockfile. The fix is one line.
A lockfile change rebuilt five unrelated jobs. The fix was to stop using the lockfile as a build trigger and let the cache key encode toolchain changes instead.
When pnpm audit signatures flags a package as invalid with reason 'terminated', the packument HTTP fetch failed, not a signature failure or tampering.
A Tauri resource glob hard-failed on CI with exit code 101 because a gitignore !KEEP re-include pointed at a file that was never committed, leaving the resources dir empty on fresh checkouts.
Committing a self-contained mise bootstrap, mounting persistent cache volumes in Dagger, and enforcing the lockfile everywhere so mise.toml is the only source of truth for the toolchain.
Dagger modules install in isolation with a generated pnpm-workspace.yml that has no catalog. The project root's workspace file is never read.
Porting my Dagger module to a repo with a uv Python service and pnpm frontends broke the lockfile-first cache trick, because uv builds the project at install time and pnpm does not.
One container, ten checks, local/CI parity, and three bugs that taught me how Dagger works.
Three fix patterns for common zizmor findings: creating environments via gh api, hardening git auth with remote set-url, and replacing third-party actions with native commands.
Running zizmor --persona=auditor surfaced six findings across two repos that the default persona and --pedantic flag both missed.