标签：#acti

Getting a rejection email from App Review feels personal. It usually isn't. Apple runs the same review process against every submission, and most rejections trace back to a small number of guidelines that come up again and again. Knowing which ones, and what they actually mean, turns a vague rejection into a fixable checklist. How often this actually happens Apple's own 2024 App Store Transparency Report puts real numbers on this. Out of 7.77 million app submissions reviewed that year, 1.93 million were rejected, roughly 25%. Of those, 295,109 were fixed and approved on resubmission. Separately, 82,509 already-live apps were removed after the fact, most commonly for guideline or design violations (42,252), followed by fraud (38,315). Apple hasn't published a breakdown of rejections by specific guideline number, so treat any listicle claiming "62% of rejections are X" as unsourced. What Apple has said, in its own commentary alongside the report, is that the most common drivers, in order, are performance and bugs, legal issues, design problems, business-model (payment) violations, and safety risks. That ordering lines up with the specific guidelines below. The guidelines that actually catch people These are pulled directly from Apple's current App Store Review Guidelines, not paraphrased from a third party. Guideline 2.1, App Completeness. Covers crashes, obvious bugs, placeholder content, broken demo accounts, and non-functional in-app purchases. If a reviewer can't get past your login screen or your app crashes on launch, this is the line it gets cited under. It's the single most avoidable category, because it's the one you can actually test yourself before submitting. Guideline 4.2, Minimum Functionality. Your app has to be more than "a repackaged website." Apple wants "lasting entertainment value or adequate utility." A thin wrapper around a web view, with no native functionality added, gets flagged here. A sub-clause, 4.2.6, specifically targets apps built from c

Have you ever stopped to think about the risk of having a pipeline where any merge into the main branch deploys straight to production without a single safety gate? For a long time, our workflow here was that classic setup almost every developer has used at some point: merge on main triggering an SSH script with git pull and pm2 restart It worked for day-to-day tasks, but it gave a false sense of stability lol The reality check hit when I found a critical blind spot in the automation: remote SSH scripts were running without strict error handling. In other words, if a git pull caused a conflict or a database migration failed halfway through, the script simply ignored the failure, ran to the end, and GitHub Actions marked the pipeline as green The absolute worst-case scenario for monitoring: the pipeline reported that everything went smoothly, while production was already completely down On top of that, the execution order was inverted: database migrations were running before the application build. If TypeScript threw a type error right after, the database schema had already advanced while the new code never booted. And since Prisma has no native down migrations, rolling back meant a high-risk manual intervention I decided to stop everything and redesign our delivery pipeline from scratch, starting from one clear premise: a tag is a release, a merge is not Today, nothing touches the production server without an annotated SemVer tag, going through 6 tightly coupled stages: Strict tag validation: only accepts annotated tags matching vX.Y.Z, ensuring author, timestamp, and audit trail for every single release Quality gates across PR and Release: automated tests with Vitest, strict typechecking, builds, and migration validation against a clean database via workflow_call Decoupled backups: an independent daily scheduled routine combined with a mandatory safety snapshot right before touching production Real migration dry-run: the most valuable gate, where the pipeline resto

The Quest Begins (The "Why") I still remember the first time I opened a legacy codebase and felt like I’d stepped into a dark dungeon without a torch. The file was a single 800‑line function called processData . Inside, variables bore names like tmp , x , flag , and comments that tried to explain every line: // TODO: refactor this mess function processData ( input ) { let r = []; // result array for ( let i = 0 ; i < input . length ; i ++ ) { // loop over items if ( input [ i ] > 10 ) { // if value greater than threshold let v = input [ i ] * 2 ; // double it if ( v % 2 === 0 ) { // if even r . push ( v ); // add to result } } } return r ; } I spent three hours tracing why a certain edge case produced an empty array, only to discover the comment “if value greater than threshold” was outdated—the threshold had changed to 12 in a later commit, but the comment never got updated. The code lied, the comments misled, and I felt like a hero who’d just swung at a shadow. That frustration sparked a question: What if we could write code so clear that comments became unnecessary? Not because we’re lazy, but because the code itself tells the story. The Revelation (The Insight) The treasure I uncovered wasn’t a new framework or a slick library—it was a mindset shift: make the code self‑documenting through intention‑revealing names and small, focused functions . When a variable, function, or class name reads like a sentence, the reader can infer what’s happening without a side note. Think of it like reading a well‑written novel. You don’t need footnotes to understand that “She opened the door and stepped into the rain” means she’s going outside. The same principle applies to code: if you name a function filterValuesAboveThreshold , the intent is obvious. Why does this matter? Because comments decay. They become outdated, they get ignored, and they add noise. Self‑explanatory code, on the other hand, stays accurate as long as the name stays accurate. It also forces you to think ab

The organizations embracing hybrid agile models aren't making a principled methodological choice — most of them are just formalizing the mess they were already living in. Picture a delivery team at a mid-sized European bank. They run two-week Scrum sprints — daily standups, sprint reviews, the whole ceremony. They use Jira boards. They call themselves agile. And then, every quarter, a Release Approval Board convenes to review a 47-page change documentation package before anything goes to production. The sprints are agile theater. The real schedule is a Gantt chart that lives in somebody's SharePoint. Nobody says this out loud in the all-hands. They don't need to. This scenario — the sprint-shaped container wrapped around predictive, gate-controlled delivery — has quietly become the dominant operating model in software delivery. According to the 18th State of Agile Report, 74% of organizations now report using hybrid or homegrown models, mixing and matching agile with whatever else their org chart demands. The consulting firms have a polished name for it: hybrid delivery. The people living it often have a less flattering one. Here's the uncomfortable argument worth making: the rise of hybrid agile isn't evidence that organizations have matured past ideological purity. For many of them, it's evidence that they never committed to anything in the first place — and now have a framework-shaped fig leaf to cover that fact. The hybrid model is legitimate. Claiming you've adopted one when you've actually just left the org chart untouched while duct-taping Scrum on top? That's a different animal entirely. How We Got Here The path from "pure agile" to hybrid wasn't a straight line. It started with a real problem. As organizations tried to scale agile beyond small teams, limitations became visible — among them, agile's tendency to underweight documentation and its friction with physical product iteration cycles, both of which created compliance and maintenance headaches in regu

Logitech increased prices by up to 25 percent last year.

We run an automated publishing pipeline entirely on GitHub Actions cron schedules — no server, no queue, just workflows that wake up, do one thing, and commit the result. It mostly works. But there is one behaviour of scheduled workflows that the docs mention in a single quiet sentence and that will silently halve your job frequency if you design around the cron expression instead of around reality: Scheduled workflows do not fire as often as you declare. What we measured We had a feedback-watcher workflow declared at four runs per hour: on : schedule : - cron : ' 7,22,37,52 * * * *' Measured over days, it actually fired one to two times per hour — not four, and not at the declared minutes. Roughly hourly on most days, at inconsistent offsets from the declared slots. We later redeclared it at two runs per hour ( 7,37 * * * * ) — measured result: still one to two runs per hour. The declared frequency changed by 2x; the delivered frequency barely moved. This is not an outage and not a misconfiguration. GitHub's own documentation says the schedule event can be delayed during periods of high load , and that high load times include the start of every hour — which is precisely where naive cron expressions cluster — and adds: "If the load is sufficiently high enough, some queued jobs may be dropped." What the docs understate is the magnitude: in our observation, on a private repo, "delayed" in practice meant "throttled to a fraction of the declared rate, indefinitely." What this breaks The failure mode is subtle because nothing goes red. Every run that happens succeeds. The runs that don't happen leave no trace — no log, no failure email, nothing. You only notice if something downstream depends on the frequency: We had promised a "reply within 15 minutes" SLA on incoming feedback, initially backed by the 4x/hour schedule. The schedule couldn't hold it, so for a while we ran a local 15-minute scheduler as the primary path and kept the workflow as fallback. When we later rel

The warning landed on the only people who had done it properly I maintain a linter that reads agent config files — SKILL.md , AGENTS.md , CLAUDE.md — and fails CI when they bake in something that only works on the author's machine. One of its rules says: if you call an external CLI, declare it, or the next person won't have it. Declaring it means naming it in frontmatter: requires : codex Except that anyone with more than one dependency writes the list form, because that's what YAML is for: requires : - codex - gemini My implementation only read the first shape. So the block list — the normal way, the way you write it the moment you have two of anything — was invisible to the linter, and it warned you for an undeclared CLI that you had, in fact, declared. Read that back slowly. Authors who ignored the dependency question entirely were never flagged, because they never wrote a requires: key at all. Authors who sat down and wrote the contract properly got a warning telling them they hadn't. The rule was inverted with respect to the thing it was trying to encourage. I shipped that. It went out in a patch release, and I only found it because a commenter used the phrase "dependency contract" and I went to re-read my own implementation of it. Then it happened again. Twice, in one release Two comments on a post of mine turned into new rules. One of them, unverified-write , reports a file that changes external state — git push , npm publish , an INSERT — and never reads that state back anywhere. Before publishing, I ran it over 586 real skill files pulled from a public registry, found two false-positive shapes in the data, fixed both, and re-measured. Fire rate 0.7%, and every hit I could check by hand was genuine. I felt good about it. Then I handed the diff to a different model for a pre-publish read, and it produced this input in about a minute: Never run `git push --force` from this skill. That is a git push in a code span, in a file with no read-back anywhere. My rule

I manage the YouTube longform queue for my BuilderStack channel as JSON files in content/yt-longform-queue/ . A spec file lands there when a generator script commits a new dialogue; the publish workflow picks the file, renders it to MP4, uploads it, then moves the file to uploaded/ . No external queue service, no database rows, no management dashboard. This has worked for three months without a major incident. Four patterns kept it from collapsing. Archetype-priority picking, not FIFO First-in, first-out publishing breaks when you have product walkthrough videos, educational deep-dives, and weekly recap specs all in the queue simultaneously. A recap spec committed yesterday would block a product walkthrough from two weeks ago if the queue ran FIFO — and the product content is what actually grows the channel. The picker uses an explicit priority rank: RANK = { " product_findindiegame " : 0 , " product_ossfind " : 1 , " hidden-gem " : 1 , " build_in_public " : 2 , " technical " : 3 , " curated " : 4 , " meta " : 4 , " contrarian " : 6 , " recap " : 7 , " ai_tools " : 7 , } DEFAULT_RANK = 5 Archetypes not in the dict fall to DEFAULT_RANK = 5 — the middle, not the bottom. New formats I haven't classified yet still air rather than sitting perpetually at the end. Within each rank tier, files sort by filename (oldest-first). The archetype value comes from the spec JSON's top-level archetype field, falling back to a prefix match on the filename for older files that predate the field. One consequence: adding a new archetype name to the dict can reorder the queue overnight. I've done this intentionally to let a backlogged product video jump ahead of a stale recap. 21-day stale expiry Queue files include a date prefix: YYYY-MM-DD-<slug>.json . The picker removes files whose date is more than 21 days old before selecting what to publish: MAX_AGE_DAYS = " ${ QUEUE_MAX_AGE_DAYS :- 21 } " CUTOFF = $( date -u -d " ${ MAX_AGE_DAYS } days ago" +%Y-%m-%d ) for f in content/yt-longform

The Quest Begins (The "Why") I still remember the first time I opened a pull request that looked like a novel written by someone who’d had too much coffee. The file was 800 lines long, a single function tried to validate input, fetch data from three different APIs, transform the result, update the UI, and log everything to a console that no one ever looked at. I spent three hours stepping through it with a debugger, only to realize the bug was a typo in a variable name buried three levels deep in a nested if‑statement. When I finally fixed it, I felt like I’d just defeated a dragon… only to discover the dragon had a dozen smaller dragons hiding in its caves. That experience left me wondering: Why does code feel so hard to read, even when it works? The answer wasn’t a fancy framework or a new language feature—it was a simple habit I’d overlooked: making every function do one thing, and do it well . Once I started treating that rule like a sacred oath, the dragons started to shrink, and my code began to feel like a clean, well‑lit hallway instead of a dark, tangled forest. The Revelation (The Insight) The principle is straightforward, yet its impact is massive: each function should have a single responsibility . If you can describe what a function does with a single verb phrase— validateUserInput , fetchUserProfile , renderDashboard —you’re on the right track. If you need an “and” or a “but” in that description, you’ve probably got more than one job packed in. Why does this matter? Readability : A reader can grasp the intent in seconds, not minutes. Testability : Small, focused functions are trivial to unit test. You can mock dependencies and assert outcomes without setting up a whole saga. Debugging : When something goes wrong, the stack trace points you directly to the guilty function, not to a 20‑line monolith where you have to hunt for the offending line. Reusability : A function that does one thing well can be dropped into other parts of the codebase (or even oth

The problem Your VPN client shows a green "Connected" toggle. That's a marketing claim, not a proof. A tunnel can be up while DNS leaks, IPv6 bypasses the route, or your "anonymous" egress sits in a datacenter that any service can fingerprint. How ActiveVPN works The scan collects five groups of signals: Network interfaces — checks psutil.net_if_addrs() against patterns like tun, tap, utun, wg, ipsec, tailscale, zerotier. Processes — iterates running processes and matches them against known VPN/Tor binaries using exact/CLI-token matching (this removed a lot of naive-substring false positives, e.g. "vpn" matching random apps). External IP — queries ip-api.com, ipinfo.io, and ipapi.co in a failover chain for IP, ISP, country, hosting, and proxy flags. DNS — calls edns.ip-api.com to find the resolver IP your DNS queries actually go through. IPv4/IPv6 — fetches both via ipify to spot IPv6 leaks around an IPv4-only tunnel. Verdict scoring Each signal has a weight (interface 50, VPN process 40, Tor 35, hosting 25, proxy 30). The sum, capped at 100, maps to: 0-19 CLEAN 20-39 SUSPICIOUS 40-74 LIKELY VPN/PROXY 75-100 VPN DETECTED Extras worth mentioning Kill switch: sudo activevpn --kill / --kill-force. Watch mode: activevpn --watch 30 with on_change callbacks for VPN-drop alerts. History & export: JSON/CSV/TXT from the platform data directory. Exit codes (0/1/2) so you can wire it into CI. Library API: import activevpn; result = activevpn.scan(); result.verdict.label. Docker image + GitHub Pages docs + full pytest suite running on 3 OSes across Python 3.8 and 3.12. Install pip install activevpn activevpn GitHub: https://github.com/rkriad585/ActiveVPN Docs: https://rkriad585.github.io/ActiveVPN

Pinterest has revealed the Resource Provisioner Pipeline (RPP), its own Terraform execution engine. It ensures least-privilege access and needs dual-control reviews. This is important for the company’s AWS infrastructure, as it adds strict guardrails to the GitHub Actions workflows. By Claudio Masolo

GitHub consolidated the npm and Actions changes it shipped from March to July 2026 against supply chain attacks, several of which alter defaults rather than add options. Hacker News discussion focused less on the individual controls than on whether waiting periods are the right instrument, or a substitute for author-side package signing. By Steef-Jan Wiggers

A GitHub product launch is being held back by the CI/CD platform underneath it. On August 6 GitHub filed a Changelog entry announcing that Kimi K3, an open-weight model, is now generally available in GitHub Copilot, then added an editor's note the same day: the rollout is temporarily paused while GitHub mitigates an incident with GitHub Actions. What the entry says, and what it does not Per the note, GitHub will resume the rollout as soon as possible and update the docs with Kimi K3 pricing: $3 per 1M input tokens, $15 per 1M output tokens, and $0.30 per 1M cached input tokens. That is the extent of the disclosure. The Changelog does not describe the Actions incident, does not put a scale on its blast radius, and does not commit to a resume time. It also does not explain how a Copilot model rollout ends up gated on Actions in the first place; a reader can infer that some provisioning or feature-flag step rides the same platform, but the entry does not say so. Availability is qualified in a way worth flagging. Kimi K3 is GA on paper, but the switch that actually turns it on for end users is paused. The operational read There is a coupling here worth naming plainly. GitHub sells Actions as CI/CD for everyone else, and it also uses Actions to ship its own products. When Actions has a bad day, GitHub's launch calendar has a bad day too, in public. That is not a scandal; it is what dogfooding looks like when the changelog is a live document. It is also a data point for any team running a rollout on top of a hosted CI platform: your feature-flag flip is downstream of somebody else's incident queue, and you inherit that queue's MTTR whether or not it is on your status page. Two follow-ups are worth watching. First, whether the resumed rollout entry names the incident and its cause, or whether it stays silent. Second, whether Kimi K3's published pricing survives the pause unchanged. Until then, the GA label is doing work the runtime cannot back up.

Introduction to Clean Architecture Clean architecture, a software design philosophy championed by the renowned Robert C. Martin (Uncle Bob), has revolutionized the way developers approach system design. By prioritizing the separation of concerns and promoting independence From frameworks, user interfaces, and databases, clean architecture empowers developers to build robust, maintainable, and scalable systems. This design approach is not just a theoretical concept, but a practical solution for real-world problems. In this guide, we'll explore the principles of clean architecture and provide a step-by-step roadmap for implementing it in your own projects, so you can get started with clean architecture and Unlock its full potential. Independent of Frameworks: Your business logic shouldn't depend on external libraries Testable: Business rules can be tested without UI, database, or external services Independent of UI: You can swap web UI for console UI without changing business logic Independent of Database: You can swap SQL Server for MongoDB without changing business rules Independent of External Services: Business rules don't know about external services Core Principles Clean Architecture organizes code into concentric circles, with dependencies pointing inward: 1. Entities (Inner Circle) These are the business objects of your application. They contain enterprise-wide business rules and are the most stable part of your system. public class User { public string Id { get ; set ; } public string Email { get ; set ; } public string Name { get ; set ; } public bool IsValid () { return ! string . IsNullOrEmpty ( Email ) && Email . Contains ( "@" ); } } 2. Use Cases (Application Layer) This layer contains application-specific business rules. It orchestrates the flow of data to and From entities. public class CreateUserUseCase { private readonly IUserRepository _repository ; public async Task < User > Execute ( CreateUserRequest request ) { var user = new User { Email = requ

When I first started contributing to open source, GitHub Actions felt like a black box. Seeing a failed workflow on my pull requests was intimidating because I didn't really understand what was happening behind the scenes. Well, this month, I decided to change that. What I Worked On I implemented GitHub Actions across three of my project repos. My main focus was: Adding Markdownlint for Markdown quality Adding Pylint for Python linting. Updating documentation while integrating CI. What I Learned The biggest lesson wasn't technical — it was changing my mindset. A failed workflow isn't something to fear. It's simple feedback. Whether it's markdownlint warning or a pylint error, each failure helps improve the project. Looking Ahead Most of this month was spent improving my own projects, so I didn't contribute much to external repositories. Next month, I want to build on this foundation by contributing to more open source projects and applying what I've learned. Sometimes, learning the tools behind open source is just as valuable as making another pull request. I'm curious What part of GitHub Actions or CI/CD was the most challenging when you first started? Or If you are just getting started, what's the biggest thing that's still a mystery to you? I'd love to hear your experience and tips in the comments. Transparency Note: I used AI as an editor—not as the author. For this article, it helped refine the structure and improve the English grammar. The technical content, experiments, opinions, and conclusions are my own and were reviewed by me before publishing.

Dependabot keeps your dependencies current, but its defaults can flood your repository with pull requests. Here's how grouping updates, slowing the cadence, and keeping security fixes fast cut the noise on a Microsoft open source project. The post Tame Dependabot: Group your updates, slow the cadence, keep security fast appeared first on The GitHub Blog .

A few weeks ago I needed to check something in the Action Mailer docs, just a quick lookup. I ended up spending much more time there than expected and found a few features I had no idea existed, even though I've been using Action Mailer in production for a while. One of them lets you see an email before it's ever sent. Another lets you modify an email right before it goes out. And the third one allows you to override the default delivery options dynamically. I figured I probably wasn't the only one who had missed these, so here are three Action Mailer features that caught my attention. If you want to explore more, the official Action Mailer documentation is always a great place to start. 1. Previews Before I found this, testing an email meant sending it to myself, checking my inbox, tweaking the template, and repeating. Turns out ActionMailer has a built-in way to preview emails in the browser, without sending anything. You add a preview class in test/mailers/previews like: class InvitationMailerPreview < ActionMailer :: Preview def team_invitation InvitationMailer . with ( user: User . first , company: Company . first ). team_invitation end end And visit http://localhost:3000/rails/mailers/invitation_mailer/team_invitation . This removes the usual feedback loop of tweaking a template. You just refresh the browser instead. Rails also allows custom preview paths if you want to keep previews in a different location: config . action_mailer . preview_paths << " #{ Rails . root } /lib/mailer_previews" This was a small discovery, but it immediately improved my workflow. 2. Interceptors An interceptor is a hook that runs right before an email is handed off for delivery, letting you modify it. A common use case is preventing mistakes in staging environments. Nobody wants to accidentally send a real looking email from a staging application to an actual customer. Another common approach is redirecting all outgoing mail in staging or development environments to a single defaul

Explore the changes we've shipped across npm and GitHub Actions over the past few months to disrupt supply chain attack techniques and limit their impact. The post Disrupting supply chain attacks on npm and GitHub Actions appeared first on The GitHub Blog .

🦄 I shipped a linter that fails your commit if you won't admit AI touched the code, and then did the most predictable thing possible—let nine months of the data sit there untouched while I busied myself with other things. Then I actually looked at it: nine months of footers piled up in git log like a lonely change jar. Every one of them said how much of those commits were mine, but I hadn't ever sat down and actually counted the jar. So I built the thing to count it. 🪙 The Jar Nobody Counted 🫙 Nine months of commits, every single one carrying a footer that states how much of it I actually wrote, and I could not have told you the number—not roughly or even within twenty points. It was all sitting in git log , structured, and enforced on every commit by a hook I built specifically for that purpose. But it was completely inert. Dropping change in a jar isn't the same as knowing how much money is in it. rai-lint will block your commit until you write the footer, but then it's done—the pile just sits there, and I never built the thing that adds it up. anchildress1 / rai-lint Dual-language linter for Responsible AI commit footers — shared logic for Node (commitlint) and Python (gitlint). Stop playing hide-and-seek with AI in your commits. A dual-language validation framework that makes AI attribution non-negotiable. 📊 Project Stats 🗣️ Languages 📦 Packages 🤖 AI & Automation 🔧 Quality & Standards Installation • Quick Start • Required Commit Footers • Documentation What is this? 🤖 RAI Lint enforces Responsible AI (RAI) attribution in every commit. No more "who wrote this?" moments. No more mystery code. Just honest, trackable AI contributions. Read the full story: Did AI Erase Attribution? Your Git History Is Missing a Co-Author %%{init: {'theme':'dark'}}%% flowchart LR A[Developer Commits] --> B{Has AI Footer?} B -->|Yes| C[Commit Accepted ✅] B -->|No| D[Commit Rejected ❌] C --> E[Clear AI Attribution] D --> F[Add Footer & Retry] Loading Why does this exist? Because transpa

Six failed CI runs. Thirty-six hours of GitHub Actions time. Every run timing out at exactly the 6-hour limit. The culprit was one line in tests/setup.js . The Setup We were building a multi-tenant platform with a PostgreSQL backend — around 76 database models handling everything from user accounts and billing to visitor logs and real-time notifications. The test suite had grown to roughly 1,140 test cases across 36 files. Standard stuff. CI ran on every PR. Tests passed locally. And then one day, CI just... never finished. The Anti-Pattern Here's what the test setup looked like: // tests/setup.js beforeEach ( async () => { const tableNames = await getTableNames (); // 76 tables await sequelize . query ( `TRUNCATE TABLE ${ tableNames . join ( ' , ' )} CASCADE;` ); }); The intent was clean isolation — every test starts with a blank slate. Reasonable in theory. Catastrophic in practice. The Math Do the multiplication: 76 tables × 1,140 tests = 86,640 TRUNCATE operations Each TRUNCATE TABLE ... CASCADE is not a cheap operation. PostgreSQL has to: Acquire exclusive locks on all referenced tables Walk the foreign key graph to find dependent tables Truncate each in dependency order Release locks With a moderately complex schema where most tables reference others (users → societies → members → invoices → payments → ...), a single TRUNCATE ... CASCADE on a central table can fan out into dozens of implicit truncations. Multiply that by 86,640 and you have a test suite that will never complete within any reasonable timeout. Why It Wasn't Caught Sooner Two reasons: 1. It used to be fast. When the suite had 50 tests and 20 tables, this pattern worked fine. 50 × 20 = 1,000 truncations — uncomfortable but survivable. Nobody noticed when the suite crossed a tipping point. 2. Local runs used a different database state. Locally, developers often ran a subset of tests with --grep or file-specific runs. The full suite was only ever run on CI, and CI was slow enough that most assumed i