| |
| ▲ | efficax 15 hours ago | parent [-] | | Where I work, we've moved CI "left", all tests are run on the developers machine before merging | | |
| ▲ | esafak 14 hours ago | parent [-] | | You're not shifting left unless you guarantee local tests always run, faithfully to production. That rarely happens. Local testing should be supplementary. We use https://hk.jdx.dev/ | | |
| ▲ | efficax 14 hours ago | parent [-] | | We do ensure this, requiring signed proof, running in containers that would be identical to github runners (more or less). Now, this could be spoofed by an engineer, but we operate in a high trust environment | | |
| ▲ | esafak 14 hours ago | parent [-] | | This is interesting. Are you using an available product for managing these signatures, or did you write your own? | | |
|
|
|
|
