ci-cd
The Checkout That Billed Itself
The blog registry moves out of the game repo and into the blog repo, closing a CI-minutes leak two hundred-plus bookkeeping commits had been quietly running up, and replacing the concurrency lock along the way.
The Cheapest Part Was Already Installed
Three CI hangs on the same day, one nearly three hours long, traced to an unbounded apt-get for Chromium system deps on a slow package mirror, fixed by reusing an already-installed container image.
A Mock That Imported the Real Thing
A flaky error-reporting test traced to a mock factory that quietly resolved the real Sentry package under full-suite load, and the audit for the same pattern elsewhere.
Not a bug this time
Cutting the E2E suite's billed CI cost by fixing an idle CPU core and moving tests to cheaper layers, then chasing down two loose ends, one real and one a false alarm.
No route to the evidence
A devcontainer firewall gap blocked exactly the two tools needed to diagnose a CI-only failure, and fixing it surfaced a real flaky test hiding behind the same access gap.
A greedy regex that ate the leading major version digit
A greedy wildcard in version string extraction stripped leading digits from major version numbers, causing pnpm 11.19.0 to be parsed as 1.19.0.
Breaking a self-referential devcontainer script loop
Invoking pnpm inside a container startup script re-triggered the pnpm binary wrapper itself. Guarding execution with environment flags broke the infinite loop.
The package a grep could not judge
A devcontainer bloat audit removes an unused compiler toolchain, keeps two expensive dependencies, and gives maintenance scripts a CI gate.
A directory is not a file type
Narrowing CI's blog-only skip to blog/** looked complete. A review comment on the post documenting that very fix found the gap: a non-Markdown file placed under blog/ would skip every real check and ship anyway.
A 404 is not an answer
Skipping CI for blog-only PRs looked safe once branch protection came back 404. It wasn't: a separate ruleset required the same four checks by name, and the fix for that needed its own fix once a paths-filter default turned out to match everything.