Tag: CI/CD
All the articles with the tag "CI/CD".
-
Renovate: dependency updates that don't drive you mad
Renovate instead of a flood of one-off PRs per dependency: packageRules grouping, schedules, automerge with a cooldown, and a self-hosted GitLab CI run. We cover the flow, the config, and where the automerge trust boundary sits.
-
Trivy in CI: catch vulns and generate an SBOM before prod
One pipeline step blocks vulnerable images from shipping and hands you an SBOM on the way. What Trivy scans, how to gate on severity, how to quiet the noise with .trivyignore and VEX, and how it ties into keyless signing.
-
Flux in one evening: GitOps for a single small cluster
GitOps on a single small cluster without an operator zoo: what Flux is, why a reconciler beats kubectl apply from CI, how to run flux bootstrap, and how to assemble one root Kustomization that syncs the whole cluster from git.
-
SLSA Level 2: what build provenance is and why it isn't SBOM
SLSA Level 2 in practice: how build provenance differs from an SBOM, why L2 is a realistic target, how the GitLab Runner itself generates a non-forgeable attestation, and how to verify it with glab/cosign and at admission.