Software Supply Chain Controls
A delivery pipeline pulls in code, packages, base images, and actions it did not write. This post builds the controls that identify, verify, and bound those inputs.
-
-
Progressive Delivery and Compatible Changes
Deploying an artifact does not decide who sees it or whether old and new versions can coexist. This guide covers canaries, flags, compatibility, telemetry and rollback.
-
Deploying the Same Artifact Across Environments
A passing test only describes what was deployed if the same artifact moves through every environment. This guide covers config, secrets, gates, validation and rollback.
-
Designing CI Pipelines and Trust Boundaries
A CI pipeline runs code from many parties while holding credentials. This guide covers stages, secrets, untrusted changes, dependency pins, isolation, and evidence.
-
Reproducible Builds and Immutable Artifacts
Which exact bytes are running in production, and could you build them again? This guide covers dependency locking, deterministic builds, provenance, immutable artifacts, and configuration boundaries, with examples and the output of local runs.