How caching desktop sysdeps saved 48 seconds in Shitty, and why parallelizing Clippy with cargo-nextest cut DeepBlock's CI from 10 minutes to 5.
The eight-job workflow that builds, installs, and byte-verifies a Tauri release across macOS and Debian, and the gotchas that shaped every guard in it.
I ran the same CI checks through Dagger containers and native mise-driven GitHub Actions on the same commit, and measured a 78% test-time cut once the Rust cache actually stayed warm.
How a DeepBlock release job went from a 45-minute timeout to a two-second failure exit, in one afternoon of trial and error with runner disk space, APT stalls, and duplicate builds.
An unquoted recursive glob made Lychee scan seven shallow HTML files in GitHub Actions while the quoted local command reached the full generated Astro site.
A source trace explains why Dagger's BuildKit cache bridge works on 0.20.1, disappears in 0.21, and leaves type=gha with no effect.
A decision guide to persistent engines, host-side cache bridges, registry proxies, and cold execution after Dagger 0.21 removed BuildKit remote export.
Renovate bumps mise.lock but a version pinned inside a workflow run step stays stale, and MISE_LOCKED=1 then aborts. Install tools by name and let the lockfile decide.
Porting my Dagger module to a repo with a uv Python service and pnpm frontends broke the lockfile-first cache trick, because uv builds the project at install time and pnpm does not.
One container, ten checks, local/CI parity, and three bugs that taught me how Dagger works.
Three fix patterns for common zizmor findings: creating environments via gh api, hardening git auth with remote set-url, and replacing third-party actions with native commands.
Running zizmor --persona=auditor surfaced six findings across two repos that the default persona and --pedantic flag both missed.