The deployment had no resource limits. Memory leaked. The node crashed. Three pods died.
The developer missed the requirement. Code review missed it. CI passed. Tests skip resource checks.
Admission control stops this. Before etcd. Before production. Before damage.
The email arrived on a Monday. "SOC 2 audit in 30 days. Need evidence of secure development practices."
We had policies. Documentation. Training slides. None of it mattered.
Auditors don't want to hear what you say you do. They want to see what the system forces you to do.
You updated golangci/golangci-lint-action to v9. CI failed. Welcome to golangci-lint v2.
The new version has stricter errcheck rules by default. Functions that return errors need handling. Yes, even fmt.Fprintln.
Here's how to fix it properly.
Your first commit after cloning a repo takes 30 seconds. Why? Pre-commit is compiling Go from source.
Binary releases fix this. Ship hooks backed by pre-built binaries.
Go works well for GitHub Actions. Single binaries, fast starts, cross-platform builds, and no runtime deps.
Here's how to go from code to release.
"The code looks correct" is not the same as "I ran the code and it works."
This distinction costs engineering teams hours every week. Failed CI runs. Broken deployments. Embarrassing rollbacks. All because someone pattern-matched instead of verified.
Here's a framework for building verification into your workflow.
AI coding assistants are increasingly the first responders to pre-commit failures and CI errors. The error messages your CLI produces directly influence how these agents attempt fixes. Often, these fixes happen without human review.
Here's how to design CLI output that guides AI agents toward correct remediation.
I just published readability, a GitHub Action that checks docs. But this post isn't about metrics. It's about the release system that makes shipping easy.
My workflow reads deployment mappings from a ConfigMap mounted as a volume. Five milliseconds, zero API calls. But what happens when the mount fails?
The answer isn't "return an error." It's "try the next thing."
The Terraform config was already committed. Three pull requests deep before anyone noticed. Now it's in git history. Audit logs show violations. The team is explaining how vendor lock-in crept in.
Pre-commit hooks stop this before it starts.