Release Engineering¶

2025-12-23
in Supply Chain Security, DevSecOps, Release Engineering
3 min read

The File That Wouldn't Verify: When Security Best Practices Contradict

The provenance file generated perfectly. Build completed. Release uploaded.

slsa-verifier failed:

Error: builder identity not recognized

Same workflow that worked last month. Nothing changed.

Except everything changed.

2025-12-09
in Go, GitHub Actions, Release Engineering
4 min read

Go-Based GitHub Actions: From Code to Marketplace

Go works well for GitHub Actions. Single binaries, fast starts, cross-platform builds, and no runtime deps.

Here's how to go from code to release.

2025-12-06
in GitHub Actions, Release Engineering, Open Source
2 min read

Shipping a GitHub Action the Right Way

I just published readability, a GitHub Action that checks docs. But this post isn't about metrics. It's about the release system that makes shipping easy.