ci-cd

The secret-scanner hook crashed on a multi-file commit. One missing flag in the hook definition, and it ended with checksum-pinned CI.

TL;DR: The gitleaks system hook kept crashing on multifile commits because it mishandles the file list. Instead of waiting for a fix I switched to a local hook that runs a checksum verified binary on the staged diff. I apply the same strict pinning in CI with hashed downloads and minimal permissions accepting manual updates for stronger supply chain security.

A blog pipeline that researches, writes, verifies, and publishes on its own, plus the four gates that make it trustworthy.

TL;DR: The author's blog publishes articles fully automatically via a 2-hour cron pipeline that researches, drafts, verifies, and posts without human touch. Safety comes from strong brakes: verification gates that reject bad content, automatic rollback after publishing, and escalation to humans for taste calls. Full-auto is trusted only for mechanical tasks; editorial judgment stays human.