SBOM Generation as a Required CI Pipeline Stage
Regulators now require SBOMs built into pipelines, not added after the fact.
Elise Cho
Build Stack Review — Page 4
Eliminating Works-on-My-Machine Failures in CI Pipelines
Codify your environment to stop "works on my machine" failures.
Elise Cho
SBOM Generation and Embedding in CI/CD Pipelines
Regulators now demand automated SBOMs embedded throughout CI/CD pipelines, not one-time artifacts.
Kwame Bauer
NIST Guidance on Software Supply Chain Security
Understanding which NIST document applies to your team prevents compliance gaps.
Kwame Bauer
SLSA Framework Levels and What They Require in Practice
Organizations can now demonstrate their software was built securely and hasn't been tampered with.
Elise Cho
Software Supply Chain Attacks in the Wild
Attacks doubled in pace since April, exposing structural weaknesses in software dependencies.
Kwame Bauer
SLSA Framework Adoption in CI/CD Pipelines
Google's production-tested framework brings supply chain integrity to modern CI/CD pipelines.
Kwame Bauer
Flaky Test Root Causes in Non-Reproducible Environments
Most test flakiness stems from environmental variance, not defective test code.
Ravi Petrova
Container Image Reproducibility and Provenance Attestation
Study shows Docker images rarely rebuild identically; provenance attestation offers proof instead.
Kwame Bauer
Dependency Pinning Strategies for Stable CI Pipelines
Lockfiles and hashes are necessary but insufficient without pinning your entire build environment.
Elise Cho
Internal Developer Platform Core Components and Architecture
How to connect platform components so they actually reduce developer friction instead of adding it.
Kwame Bauer
Software Supply Chain Attacks Targeting DevOps Toolchains
Self-replicating malware and compromised maintainers are turning registries into weapons.
Kwame Bauer