github-actions

CI called pytest on an empty database while production applied migrations first; one workflow line aligned both contracts.

TL;DR: A test suite that passed locally kept failing in CI with misleading database errors. The root cause was that production ran Alembic migrations before boot, while CI pointed pytest straight at an empty Postgres. Adding alembic upgrade head before tests in the workflow made starting state deterministic, so failures now point at actual code.

The daily cron dump could not answer which release it matched. Pairing one dump with one release tag made restores a one-name lookup.

TL;DR: Daily cron dumps caused version confusion because the file wasn't tied to the app release. Now each annotated release tag gets its own logical mariadb-dump named to match, stored via documented rules and verified by test restores. This makes recovery predictable since the dump that matches production is instantly clear.

The secret-scanner hook crashed on a multi-file commit. One missing flag in the hook definition, and it ended with checksum-pinned CI.

TL;DR: The gitleaks system hook kept crashing on multifile commits because it mishandles the file list. Instead of waiting for a fix I switched to a local hook that runs a checksum verified binary on the staged diff. I apply the same strict pinning in CI with hashed downloads and minimal permissions accepting manual updates for stronger supply chain security.

A three-lane branch model for safe deploys: main as the source of truth, staging for Vercel previews, api for VPS deploys via GitHub Actions.