PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The Tao of Continuous Integration

blog.trailofbits.com | blog | #best-practices | #testing | #developer-experience | #software-engineering | #ci | #continuous-integration
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Brittle, slow, flaky CI erodes development velocity. This essay argues CI needs a clear purpose, examining trivial tests, unreliable runs, and coverage theater, and how to build CI that earns trust.
Published
Collected

Related coverage

blog · hackerone.com
Common Best Practices for Cutting Build Times
Practical ways to cut build times: fail builds fast, fix flaky tests, optimize hotspots surfaced by coverage data, run only relevant tests, and prune low-value test cases.
blog · hackerone.com
Setting Up CI GitHub Workflows for a New Python Project
A tutorial on setting up GitHub Actions CI for new Python projects: automating linting, testing, and security checks on every push to catch issues early and enforce a consistent quality bar.
blog · hackerone.com
3 Development Anti-Patterns Disguised as Best Practices
Albert Row challenges three 'best practices': blind code reuse, never duplicating data, and strict DRY, arguing denormalization and duplication in tests are sometimes the right engineering call.
blog · blog.trailofbits.com
Rust-proof your code with our new Testing Handbook chapter
Trail of Bits added a Rust testing chapter to its Testing Handbook: Miri, property testing, Clippy, zeroization, Kani model checking and dependency vetting, plus the rust-review Claude Code plugin.
blog · blog.trailofbits.com
Making PyPI's test suite 81% faster
Trail of Bits cut PyPI's Warehouse test suite from 163 to 30 seconds via pytest-xdist parallelization, Python 3.12 sys.monitoring coverage, optimized test discovery, and trimmed imports.
blog · blog.trailofbits.com
Master fuzzing with our new Testing Handbook chapter
Trail of Bits' new Testing Handbook chapter covers fuzzing C/C++ and Rust with libFuzzer, AFL++, and cargo-fuzz, including harness writing, fuzzing dictionaries, and AddressSanitizer usage.
Back