The Queue That Deleted Itself
Eight workflows queued. Seven deleted themselves before execution. Zero wasted builds.
DevSecOps¶
The Regex That Fixed Everything
Codecov components were configured. Five components, clean breakdown by package.
Codecov dashboard: "No report uploaded" for all components.
Coverage uploaded successfully. Components showed zero coverage.
The paths looked correct.
One Line: secrets: inherit
CODECOV_TOKEN worked perfectly in ci.yml.
Called ci.yml from release.yml as a reusable workflow. Codecov failed:
Same token. Same workflow. Different result.
Zero API Calls: The ConfigMap Pattern That Changed Everything
The workflows were slowing down. Not dramatically. Just... gradually. Week by week.
Then the logs started showing warnings: API rate limit approaching threshold.
100+ workflows per day. Each workflow making 2-3 Kubernetes API calls to read ConfigMaps. That's 200-300 API requests per day. Not sustainable.
The File That Wouldn't Verify: When Security Best Practices Contradict
The provenance file generated perfectly. Build completed. Release uploaded.
slsa-verifier failed:
Same workflow that worked last month. Nothing changed.
Except everything changed.
Go's Boring Security Tooling (And Why That's Perfect)
"What security tools do you use?"
I expected: Snyk. Semgrep. Custom vulnerability scanners. Expensive SaaS subscriptions.
The answer: go test -race.
That's it. That's the security tool.
The Coverage That Mattered: When 99% Became a Security Signal
The OpenSSF Best Practices Passing badge doesn't mandate a specific coverage percentage.
We set our bar at 95% minimum. Above even Gold (90%). Self-imposed. Strategic.
We started at 0%. We wanted the Passing badge. But we knew something important: it's easier to build high standards into a young project than retrofit them later. When we go for Gold, 95% would already be habit.
Sixteen Alerts Overnight: When Permissions Look Fine
The workflows had been running for months. Cosign signing. SBOM generation. Release automation.
Everything worked.
Then OpenSSF Scorecard ran: 16 Token-Permissions alerts.
The code scanning tab filled with warnings. All from one workflow file.
The Score That Wouldn't Move: Stuck at 8/10
The releases were signed. Checksums published. SBOM generated. Every asset had a Cosign signature.
OpenSSF Scorecard: Signed-Releases 8/10.
Not 9. Not 10. Eight. Stuck.
OpenSSF Best Practices Badge in 2 Hours: The Documentation Gap
Six pull requests. Two hours. OpenSSF Best Practices badge earned.
The readability project passed certification on December 13, 2025. But the work didn't start that day. It started months earlier when we built the infrastructure the badge measures.