CI/CD Pipelines
Actions, runners, caching that never hits and deploys that don't roll back.
19 articles
ArgoCD Stuck on 'Waiting for Completion of Hook': Breaking the Deadlock
Your ArgoCD sync has waited on a PreSync Job for forty minutes and Terminate changes nothing. Here is why the hook never completes and the exact steps that clear it.
Ship to Your Own VPS: GitHub Actions CI/CD Without the Cloud Bill
A complete pipeline for a 10-dollar server: test, build to GHCR, deploy over SSH, health check, roll back. Real workflow YAML with current action versions, plus the details that quietly break deploys.
Fixing Helm's "another operation is in progress" Without Nuking the Release
An interrupted helm upgrade leaves the release Secret stuck at pending-upgrade and blocks every deploy. Here is the safe unstick order, and why the label patch fails.
Helm 'has no deployed releases': recovering a broken release history
When every Helm revision is failed or pending, upgrade and rollback both refuse to run. Here is how the release Secrets work, how to repair the history safely, and how to stop it recurring.
How to Evaluate an LLM Feature Before It Touches a Customer
Vibes are not a release gate. Build the eval set from real traffic, split deterministic checks from LLM-as-judge scoring, calibrate the judge against humans, and wire the whole thing into CI so a prompt change cannot silently regress.
Helm Upgrade Stuck in PENDING_UPGRADE After a Hook Timeout: The Cleanup Path
A pre-upgrade hook outran --timeout, and now Helm refuses every retry and shows two deployed revisions. Here is why the release state froze and how to clear it safely.
JavaScript Heap Out of Memory on next build: Find the Real Cause
Raising --max-old-space-size hides the problem instead of fixing it. Three different build phases can exhaust the heap, and the last log line tells you which one you have.
npm audit Noise: Triaging CVEs Without Turning Off the Alarm
npm audit tells you a version matched an advisory range, not that you are exploitable. A four-gate triage that ends in a written decision instead of a disabled CI step.
Error Acquiring the State Lock: When Terraform force-unlock Is Safe
A stale Terraform lock blocks every apply. How to read the Lock Info block, decide in 90 seconds whether force-unlock is safe, and find the resources a killed apply orphaned.
CI Auto-Retry Is Hiding Your Flaky Tests, Not Fixing Them
Retry-on-failure keeps CI green by throwing away the one thing you need to diagnose flakiness. Here is how to make flakes visible, quarantine them, and root-cause the real nondeterminism.
Why GitHub Actions Cache Never Hits: The Wrong-File Hash and Fork-PR Traps
Your cache key looks correct but every run is a miss. The usual culprits are a hash that changes every run and forked PRs that can restore but never save.
The GitHub Actions Pwn Request: How Fork PRs Steal Your Secrets
pull_request_target plus a fork checkout hands your CI secrets to any attacker. Here is the mechanism, the tj-actions lesson, and the two-workflow fix.
kubectl 'did you specify the right host or port?': read the address first
localhost:8080 means kubectl found no kubeconfig at all. A real address means a real network failure. How to tell them apart in ten seconds and fix each one properly.
NEXT_PUBLIC_ Vars Are Baked at Build Time: Why One Docker Image Can't Serve Staging and Prod
Your prod container still points at the staging API because NEXT_PUBLIC_ vars are string-replaced into the client bundle during next build, not read at container start. The two fixes that actually work.
Next.js 16.0.1 Fails next build on /_not-found: An Open Regression
Next.js 16.0.1 can break next build while prerendering the not-found page, even though next dev works. Here is how to confirm it, pin safely, and gate CI.
useSearchParams() Should Be Wrapped in a Suspense Boundary: The Error Only Your Build Sees
Why useSearchParams() passes in next dev and kills your CI build, what the CSR bailout actually does, and the Suspense split that keeps the rest of the page static.
'Keystore file not set for signing config release' in CI But Not Locally
The Android build works on your machine and fails in CI with a keystore error that names no variable. The cause is eager signingConfig evaluation. Here is the fix.
Monorepo CI in GitHub Actions: Why Path Filters Break When Services Share Code
Workflow-level paths filters gate whole workflows, not jobs, and know nothing about shared code. Here is the detect-changes pattern that actually works.
Flaky CI Tests From Live Third-Party APIs: Mock the Boundary, Don't Rerun
Retrying a flaky test that calls a live payment or SMS API makes CI slower and less honest. Mock the boundary, verify the real integration on a schedule, and track flake rate.