Getting Started With CI/CD Pipeline Security

The increasingly distributed nature of CI/CD frameworks has made organizations more vulnerable to attacks, which can range from threats to supply chains and servers to exploitations of the application code itself. In this Refcard, you'll learn about the primary focus areas of CI/CD pipeline security, review common pipeline threats and security challenges, as well as walk through seven steps to get started with securing your pipelines.

Continuous Delivery != DevOps

Continuous Delivery and DevOps are interdependent, not equivalent

Since the publication of Dave Farley and Jez Humble’s seminal book on Continuous Delivery in 2010, its rise within the IT industry has been paralleled by the growth of the DevOps movement. While Continuous Delivery has an explicit goal of optimising for cycle time and an established set of principles and practices, DevOps is a more organic philosophy that is defined as “aligning development and operations roles and processes in the context of shared business objectives“, and gradually codifying into principles and practices. Continuous Delivery and DevOps possess a shared background in agile methods and Lean Thinking, and a shared desire to eliminate Waterscrumfall silos – but what is the nature of their relationship?

Build Continuous Delivery In

Building Continuous Delivery into an organisation requires radical change

While Continuous Delivery has a well-defined value proposition and a seminal bookon how to implement a deployment pipeline, there is a dearth of information on how to transform an organisation for Continuous Delivery. Despite its culture-focussed principles and an adoption process described by Jez Humble as ”organisational-architecture-process not tools-code-infrastructure“, many Continuous Delivery initiatives fail to emphasise an organisational model in which software is always releasable. This contravenes Lean Thinking and the Deming 95/5 Rule – that 95% of problems are attributable to system faults, while only 5% are due to special causes of variation. Building an automated deployment pipeline can eliminate the 5% of special causes of variation in our value stream (e.g. release failures), but it cannot address the remaining 95% of problems caused by our organisation structure (e.g. wait times between silos). From this we can infer that:

Key Takeaways: Adrian Cockcroft’s talk on Netflix, CD, and Microservices

One of the big draws of the O'Reilly Software Architecture Conference was Adrian Cockcroft's talk, "Deliver Faster and Spend Less with Cloud Native Microservices."  Cockcroft is an experienced speaker on the conference circuit and he's well-known as the architect who led Netflix into its new era of unprecedented scale and agility.  

He now works for Battery Ventures, but he still draws primarily on his experiences at Netflix for his talks.  He and his team were the ones behind the greatest success story for the latest trend in software architecture: microservices.

Continuous Delivery Pipeline Security Essentials

As the threat landscape continuously evolves, it is crucial for organizations to adopt a shift left for security mindset — ensuring that security is prioritized and its importance equated to that of automation and collaboration among distributed teams.

In this Refcard, you’ll review the challenges associated with integrating security practices into a continuous delivery pipeline, including the blockers development teams in particular often face. Also covered are the key areas to consider when administering and maintaining security of CD pipelines.

Continuous Delivery Patterns and Anti-Patterns

The goal for a successful continuous delivery process is to minimize the time it takes for development teams to go from idea to usable software by practicing agile techniques and automating the entire software delivery system: build, deploy, test, release. This Refcard explains detailed patterns and anti-patterns for core areas of CD, including the delivery and deployment phases, rollbacks, pipeline observability and monitoring, documentation, as well as communication across teams and within the organization.

10 Books Every Senior Engineer Should Read

Engineers are natural readers. They take enormous pleasure in learning about new things, and books are the perfect medium to cover complex ideas in depth.

I picked some of my favorite books at my company, Semaphore — books that have profoundly influenced the company’s engineering culture. This list contains a mixture of classic, timeless texts and a fair share of modern game-changing publications, aimed at senior engineers and devs. But you don’t have to be a senior engineer to benefit from the books on this list, anyone interested in software development would enrich their skillset by reading them.

We hope you enjoy reading this list as much as we enjoyed making it.

GitOps Takes DevOps Teams To Higher Levels of Maturity

Stream-Aligned and Platform Teams

The 2021 State of DevOps report identifies two types of teams as the way high-maturity teams organize themselves: stream-aligned teams and platform teams. The idea of a "platform" or "internal developer platform" is fundamental to GitOps. While a GitOps pipeline begins with committing code to a Git repository, it is made possible by a platform that paves the way for that new code to move in an automated way from the repository to a production environment.

The platform is how the Ops team provisions resources such as cloud services, storage, service meshes, and security and monitoring tools in a ready-made template. These templates are created even before they are needed and made available to any developer within the organization. The big shift due to this is that developers need not raise a ticket for the resources they need: they can pick a ready-made template and deploy their code in a matter of minutes. From the Ops side, they have peace of mind knowing they have configured this template and that it follows security protocol by default. It does not require developers to separately configure security for deployments.

Getting Started With GitHub Actions

Continuous integration and continuous delivery are crucial to the advancement of software development, and users can further reap both the business and practical benefits by integrating these concepts into their repositories. By far, the most prominent option available today is GitHub. In this Refcard, readers will learn the key concepts of GitHub Actions, as well as how to create automated workflows, or CI/CD pipelines, using text-based configurations that are stored directly within their GitHub repository.

“Move Fast, With Safety:” CloudBees Connect 2022

Where is software delivery headed in 2022 and beyond, and what role will continuous delivery play? How have organizations like yours successfully transitioned to continuous delivery-and how can you take advantage of what they've already learned? Can feature flags help pave the way, and if so, how can you avoid the most common pitfalls as you scale?

Join us on Wednesday, February 9, 2022 for a half-day event to gain insight into the future of software development and delivery-broadly, as well as at your own organization. You'll have an opportunity to attend sessions and workshops to help you accelerate your DevOps maturity. You'll also be able to network with your like-minded peers-those in similar positions, and those who have walked your path already.

Community AMA: Bryan Finster and Continuous Delivery

Continuous Delivery isn’t about how fast you can deliver, it’s about the outcome your delivery achieves. Bryan Finster, author of the 5-minute DevOps series and founder of the DevOps Dojo, joined our Dev Interrupted Discord community to answer your questions about outcome-based development, continuous delivery, and why failing small is better than failing fast. 

Bryan is currently a Distinguished Engineer at Defense Unicorns but has also worked for Walmart as a systems analyst and eventually became a staff software engineer for Walmart Labs. He had previously appeared on the Dev Interrupted Podcast to further talk about these subjects as well as the most common pitfalls dev teams find when trying to optimize their delivery process. Listen to the episode here:

Slow Build Pipeline? Build Faster by Building Only What You Need

In today’s fast-paced software world, organizations need to deliver fast, as fast as multiple times per day. Agile methodologies and DevOps culture have contributed to enabling this constant delivery. Continuous integration and continuous delivery (CI/CD) is an almost basic requirement for any company that wants to remain competitive in the market.

CI/CD allows the delivery of code changes more frequently and reliably by automating the required steps to take a working piece of software to a production environment. This automation comprises a set of steps to compile, build, and deploy code is called a “building pipeline.” 

What is DevOps?

DevOps is a mix of Development and Operations that combines people from a distributed stack and tools used to create efficient applications with the development process to enable faster delivery of quality products.

By bringing together the people, tools, and processes, DevOps enables rapid development and delivery with a scope of incremental features added to the product.

Unlocking Developer Velocity With the Right CI/CD Platform

Today, in a world where online software is expected to be available 24/7 across the globe, engineering teams writing and delivering software are expected to do so at speed, while maintaining quality and security. To help meet the challenge, online CI/CD platforms have emerged to provide everything a developer needs to plan, version, deploy, test, and promote an application from their laptop to a production environment – where an end-user can consume it and provide valuable feedback. 

This article will cover the key ingredients of a CI/CD platform, how they are evolving and whether you should try to build your own or utilize an industry leader.

5 DevOps Mistakes to Avoid

Most enterprises are somewhere along their DevOps journey to address software delivery challenges concerning cost, speed, and quality.

DevOps is founded on solving these issues by marrying development and operations and automating activities. While it has frequently proven to achieve the benefits touted, there are many learnings from those who have worked their way down the DevOps path.

Feature Flag, What? Why? How?

Velocity in agile development measures the quantity of work a team can accomplish in a sprint. It can be measured in story points, hours or days. The higher the velocity of a team, the more features it delivers, the more value it brings to customers. Sprint velocity is a good measure in sprint project management to evaluate and estimate team productivity.

The measure of the velocity is based on multiple factors: the continuous integration (CI) process, the time to qualify the code changes, to test the regression, the security, the delivery, etc…

Software Engineers Need to Know DevOps Too, and That Starts with CI/CD

DevOps is hot right now. It seems like every software engineering job posting requires DevOps experience and expertise regardless of the actual job title.

When a tech company breaks up its monolith into microservices, each of its engineering teams now owns their portion of the application from start to finish. Software engineers no longer just build the application; they also own repo maintenance, set up continuous integration, configure build pipelines, and deploy their application.