A workflow that restores dependencies from a cache is making a trust decision, not only a performance decision. GitHub Actions caches are shared by scope, and a later job restores their contents as files on its runner. A cache that a low-trust workflow can write can become an input to a trusted workflow, which is the boundary that makes cache poisoning relevant.

GitHub added cache-mode on 10 September 2026. The setting can apply at the workflow level or to one job. It has four values: read, write, write-only, and none. The useful part is that the cache service enforces the selected capability rather than expecting every cache step to make the right choice. The dangerous part is just as explicit: write and write-only can override the read-only default GitHub applies to low-trust events.

A HorizontalPodAutoscaler can reduce the replica count of a Deployment, but minReplicas: 0 changes the question from how to scale down to how a workload starts again. A CPU or memory metric describes Pods that already exist. When the target has zero Pods, there is no Pod CPU or memory value for the controller to use as a wake-up signal.

Kubernetes v1.37 moves HPA scale-to-zero support to beta and enables it by default. The supported use is an HPA using an external or object metric, such as queue depth, a pending-work count, or another signal that remains available while the workload has no Pods. The release notes explicitly exclude CPU and memory metrics from scale-to-zero because they depend on active Pods.

A focused test command is useful before a small dependency update or a narrow code change. Running one named behavior is faster than running an entire suite, and it gives a reviewer a direct answer about the part of the application that changed. The command is only useful, though, if the name filter actually selects a test.

Node’s built-in test runner accepts --test-name-pattern for that purpose. In a disposable Node 22.23.2 project, a pattern matching one top-level test returned zero. A pattern matching no test names also returned zero. Its TAP output began with 1..0, then reported the test file itself as a successful subtest. A CI job that treats the process exit status as the whole result can therefore accept a focused check that exercised none of the intended assertions.

A TLS deployment can fail before a client ever reaches certificate-chain validation. A private-key file may be truncated during a secret export, copied in the wrong encoding, encrypted with an unavailable passphrase, or simply not be the key format the service expects. A file existing at the configured path is not useful evidence that OpenSSL can read it, and a successful PEM header search is weaker still.

openssl pkey -check provides a small offline check for a private key that is already in a controlled review location. In a Linux AMD64 validation run with OpenSSL 3.5.7, a newly generated synthetic RSA key printed Key is valid and returned zero. Removing its PEM end marker made the same command return 1 before a consistency check could run. That distinction is the useful gate: first ensure the input can be decoded, then accept OpenSSL’s key-consistency result. It is not a substitute for protecting the key, matching it to a certificate, or testing the deployed TLS service.

A repository can have a branch name, a current-looking HEAD, and a clean worktree while still being unable to supply every object reachable from its history. That matters when a backup, mirror, deployment export, or migration job treats a successful git fetch as enough evidence that the repository can be copied safely.

git fsck --connectivity-only gives that review a small, local failure boundary. It walks the object graph without performing the broader object-validity checks that a full git fsck performs. In a disposable repository tested with Git 2.47.3, the connectivity check exited zero while the committed blob existed. After that one reachable blob was removed from the disposable object database, the same command reported a missing blob and exited 2. Nothing contacted a remote and no application repository was modified.

A dependency install can appear repeatable right up to the moment a package file changes behind an unchanged version pin. idna==3.10 tells pip which release to select. It does not, by itself, state which exact wheel or source archive the installer is allowed to accept. A hash-checked requirements file closes that gap by making the expected file digest part of the deployment input.

This guide builds a small offline wheelhouse and tests both outcomes with pip 26.1.2 on Python 3.13.5: a wheel whose SHA-256 digest matches the requirements file installs into a disposable target, while the same wheel with an intentionally wrong digest is rejected. The useful boundary is not a successful download. It is proving that the installer refuses a file when the declared digest and the bytes on disk disagree.

A download job can begin at an HTTPS URL and still be redirected somewhere its owner did not intend. The URL in the script tells only part of the story when curl --location follows a server response. The redirect target is another input, and it deserves an explicit protocol policy.

That review is worth doing before updating a transfer dependency. curl 8.22.0 was released on September 2, 2026, and a version update is a useful time to turn an assumed redirect policy into a tested one. The control is --proto-redir: it limits the schemes curl will accept after a redirect. For a job that is meant to retrieve web content, an explicit HTTP-and-HTTPS policy prevents curl from following an FTP or FTPS redirect just because those schemes are in curl’s default redirect allowlist.

A small Node utility that reads one configuration file can often read every file available to its service account. Containers and Unix permissions still matter, but they do not express the narrower contract: this process needs its own script, one input file, and nothing else. Node’s Permission Model provides a process-level boundary for that contract.

The important detail is how the file-read allowlist is supplied. In a clean test with Node v26.8.1, one --allow-fs-read flag for the script allowed Node to start but denied the separate input file. Repeating --allow-fs-read once for each required path allowed the same program to complete. Treat each path as its own capability rather than composing a comma-separated list into a single flag.

A Python deployment can look reproducible right up to the moment its dependency declaration and lockfile disagree. pyproject.toml may request a different package version while uv.lock still describes the previous resolution. If CI creates an environment without checking that relationship first, the job can spend time building or downloading before it identifies the real problem. Worse, a workflow that updates the lockfile during deployment turns a reviewable source change into an environment-dependent side effect.

A vulnerability queue becomes harder to use when every CVE is presented with the same urgency. CISA’s Known Exploited Vulnerabilities (KEV) catalog provides a useful signal because it records vulnerabilities that CISA says have been exploited in the wild. It is not an asset inventory, a scanner result, or a patch instruction. It is a prioritization input that still has to be matched to the products an organization actually owns.