Automation / DevOps / IaC

GitHub suffered a significant service disruption that rendered Actions and Pages unavailable. The outage effectively halted automated build processes and static site deployments for many engineering teams. This incident highlights the fragility of relying on a single provider for critical development workflows.

• CI/CD pipelines relying on GitHub Actions are completely blocked during outages.
• Static site hosting via GitHub Pages is unavailable, affecting documentation and demos.
• Teams should verify their disaster recovery plans for source control dependencies.
• Mitigation strategies for single-provider outages need immediate review.

CloudNativePG’s ClusterImageCatalog now allows extension images to be managed alongside the operand, enabling clusters to reference extensions by name alone. This recipe demonstrates deploying a community extension catalog as a single source of truth per PostgreSQL major version. When an extension is added to the catalog, all referencing clusters automatically inherit the correct image, paths, and dependencies without manifest updates.

• Reference extensions by name only; the operator resolves images and dependencies automatically.
• Adopt a single versioned source of truth per PostgreSQL major version for consistency.
• Adding an extension to the catalog propagates it to all referencing clusters instantly.
• Eliminates the need to modify individual Cluster manifests for extension updates.

npm has launched staged publishing to mitigate supply chain risks by requiring maintainer approval before a package version becomes installable. Versions are queued and must pass a two-factor authentication challenge to proceed to live status. This security feature is included in npm CLI 11.15.0+ and Node 22.14.0+ alongside new configurable permission flags.

• npm CLI 11.15.0+ and Node 22.14.0+ support staged publishing by default.
• Maintainers must approve queued versions via 2FA before they go live.
• New permission flags allow granular control over publishing workflows.
• This step adds friction to prevent accidental or malicious releases.
• Supply chain security is enhanced by introducing a human-in-the-loop gate.

Herdr, a technology startup, has entered the Y Combinator program. The company explicitly stated that its core runtime software will remain open source. This move signals continued commitment to open development despite joining a major accelerator.

• Herdr is officially part of Y Combinator now.
• The runtime software remains open source.
• No change to the open-source licensing model.