Tag: ci-cd

Keyless signed git commits with Sigstore and Gitsign—no GPG key rot, no passphrase prompts. OIDC-backed ephemeral certs that just work.

Renovate vs Dependabot for self-hosted teams: config depth, ecosystem coverage, self-host paths, and which bot wins for Forgejo/GitLab shops.

Gitea Actions vs Woodpecker CI: two solid self-hosted CI options, one clear winner for your setup. Compare syntax, runners, footprint, and secrets handling.

Argo Rollouts uses a Rollout CRD with a slick UI. Flagger watches your Deployment with a Canary CRD. Here's which progressive-delivery tool to pick.

Two Kubernetes-native pipeline engines from CNCF — Argo Workflows and Tekton. Different philosophies, same goal: stop using Jenkins. Honest comparison.

Build ARM64 and AMD64 images from one machine using Docker buildx. Setup, syntax, pushing multi-arch manifests, and when you actually need it.

Automate Docker container deployment with shell scripts, cron, and Ansible — stop SSHing in and restarting things by hand.

Using :latest in production is a ticking time bomb. Pin your Docker image versions or watch a surprise update break everything at 2 AM.

Build container images without writing a single Dockerfile — ko for Go, Jib for Java, Paketo Buildpacks for everything else. Real benchmarks, real tradeoffs.

Cosign keyless signing uses GitHub OIDC + Fulcio + Rekor to sign container images without managing private keys. Here's how it actually works and why you want it.

Orchestrating multi-image Docker builds: docker buildx bake vs compose build, matrix targets, multi-arch, caching, and when each one actually wins.

A Software Bill of Materials tells you exactly what's in your software. Syft generates one, Grype scans it for CVEs. Together they're your supply chain paper trail.