Two green GitHub pull requests broke main — require branches to be up to date before merging
Why a GitHub pull request with every check green can still break main, how Require branches to be up to date before merging stops it, and rules for main.
GitHub Actions
A GitHub Action that patches the pnpm advisories Dependabot cannot — and the authentication approach decided the solution
Dependabot cannot update transitive dependencies on pnpm. Building the GitHub Action that patches them, and why its credential decided the design.
Why GNU Make beats a root-level package.json in a Python and TypeScript monorepo
GNU Make as a task runner for a polyglot repo: prerequisite composition npm scripts cannot express, CI calling the same targets, and GNU Make 3.81 on macOS.
A GitHub Actions job that mints its own Cognito M2M token to test what it just deployed
GitHub OIDC gives CI an AWS identity, but a JWT-authorized MCP endpoint needs a second one: a Cognito client_credentials token read from terraform output.
_override.tf runs committed Terraform in a sandbox — and apply caught what validate missed
Gitignored Terraform override files retarget a committed config at your own AWS sandbox: a local backend, overridden locals, and what only apply found.
Dependabot minimum release age and auto-merge — the trap in a private repo
On a private repo the dependency graph is off by default, so Dependabot opened no npm pull request, and the auto-merge workflow merged 45s before CI finished.