Three repositories, one change, and the order that stops it corrupting
Submodule pointers make commit order load-bearing. Parent first records a SHA nobody else can fetch, and automation can silently revert one.
Shipping
Stores, signing, provisioning, CI — the archaeology between "it builds" and "it is live".
27 posts
Every .env file in my projects is gone and nothing broke
A local secrets file is a copy nobody controls. An encrypted vault that materializes per ecosystem removes the copy rather than protecting it.
What act can reproduce, and what it silently cannot
Local workflow runners reproduce containerised jobs faithfully and host jobs not at all. Skip-and-warn is the only honest handling of the gap.
A hand-typed branch name skips the machinery
A branch name tidier than the generated one silently opts out of every automation that discovers work by parsing it. The naming was the interface all along.
Where a secret lives should never be a decision
Six consumers each deciding where a keystore lives agree until one changes. One registry keyed by stack and category, one resolver, no direct reads.
A number in CI is the only budget that holds
A budget that lives in a shared understanding has already moved. A baseline works because changing it leaves a reviewable diff with somebody's name on it.
Open it as a draft and let a human merge
A pull request that opens and merges in the same run is a push with extra steps. Draft is the one control that works without depending on permissions.
The Play Store checks you only fail once
Price schedule, content rating, data safety, target API: the first-release prerequisites that reject a submission after the build already succeeded.
Your deploy said zero changed because it never looked
A deploy that ships whatever is already built never regenerates. Fifteen posts had new frontmatter, it reported 0 changed, and every link stayed stale.
Pin a commit, not a branch, when someone rehosts your images
A branch URL serves whatever the branch holds now, and a platform that rehosts your images keeps its copy forever. The pin must be immutable.
The keychain repair that broke signing for a day
Removing a stale tmp keychain cleared the default and broke iOS signing machine-wide, while the provisioning repo I spent a day suspecting was never at fault.
Setting a secret on the repo is how it stops having an owner
A repo-side secret has no owner, no rotation path and no inventory. One vault, propagation outward, and a guard that refuses the paste.