Tooling & workflow
4 posts tagged #ci on DiCodeWeb, from fundamentals to production, newest first.
4 postsUpdated Oct 31, 2026
What counts as a secret, how .env files and long-lived CI tokens actually leak, what to do in the first hour after a leak, secret stores compared, GitHub Actions OIDC to AWS and GCP instead of static keys, rotation without downtime, and typed env validation in a Turborepo monorepo.
How to read a bundle analyzer in 2026 (next analyze, rollup-plugin-visualizer, source-map-explorer), how tree shaking really works with ESM, sideEffects, barrel files and CommonJS, the usual traps like moment and lodash, duplicate dependencies, polyfills, and bundle budgets in CI with size-limit.
From Nx s1ngularity and chalk/debug to Shai-Hulud, TanStack and ChainDrop: what the npm attacks actually did, what npm and GitHub changed, and a layered defense — install, CI, publish — applied directly to a Bun + Turborepo monorepo.
Designing a CI pipeline for a Bun + Turborepo frontend monorepo: the stages you need, caching dependencies and build outputs, running only affected packages, per-PR previews, required checks and keeping secrets safe.