Stop walking the filesystem in your CI gates — ask git instead
Why Waaseyaa’s CI gate scanners stopped walking the filesystem with a hand-maintained exclusion list and started asking git what’s actually in the repository.
Ci
A nested git worktree broke our pre-push gate
A stray PHPStan cache in a nested git worktree got scanned as production code, showing why filesystem-exclusion rules for local gates need to match at any depth.
Splitting one Dockerfile into API and maintenance images
A shared runtime stage plus two build targets keeps CLI maintenance tools out of the deployed API image, and a script proves it on every build.
A missing npm ci silently starved the content-mining pipeline for a week
A missing npm ci let schema validation crash on every mined candidate, filing zero content-queue issues for a week — the fix layers a loud fail-open guard over the actual root-cause patch.
Hardening a manual Claude Code review workflow in GitHub Actions
How a human-triggered ‘@claude review’ workflow got locked down to read-only, bounded-diff, revision-verified reviews after the official tag-mode example turned out to be implementation-capable by default.