Skip to content
360SOFTY
HomeInsights

Insights

Ideas for building
better software.

Engineering perspectives on architecture, product development, AI, and the everyday decisions behind useful software.

From the engineering desk

Browse practical articles or follow the latest technology updates.

Subscribe via RSS →

Curated links from external sources — not 360Softy original articles.

ExternalSoftware Engineering
DEV Community

A GitHub Actions tag is a promise, not a fact: pinning by SHA the right way

When you write uses: actions/checkout@v4 in a GitHub Actions workflow, you are not pinning anything. You are trusting a promise. A tag is a movable pointer. Whoever owns that repository can repoint v4 at a different commit tomorrow, after you reviewed it, and every run of your pipeline will silently pull the new code. In a job that holds a registry login, a PyPI token, or a signing key, that is exactly the place you do not want a mutable reference. I recently went through a project's workflows a

securitygithubdevops
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

The Blind Leading the Blind: Chasing a Production Bug

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry. Around 2016, I was working as a PHP developer at Racing Post in London. The Post is best known for horse-racing news, form and results, but behind the public-facing products sat a large collection of systems for processing all kinds of racing and greyhound data. The application I worked on used that data to produce periodic reports. This was the PHP 5 era. The language had already powered serious web applications f

devchallengebugsmash
DEV CommunityRead original
ExternalSoftware Engineering
DEV Community

Why I'm preselling my Obsidian AI plugin before writing a line of code

Disclosure: I used an AI coding agent to collect research and draft this post. I reviewed the final copy before publishing. I started with an Obsidian plugin idea I thought was obvious. Research killed it. A different one survived, and I'm now preselling it at $19 before writing a single line of code. Here's the evidence that changed my mind, and the line I've drawn for myself. Obsidian has 1,800+ community plugins and no official way to monetize them. So developers roll their own licensing. Tha

obsidianindiehackersbuildinpublic
DEV CommunityRead original

Let’s start with a conversation

Tell us what you’re working on.

An idea, a challenge, or a system that needs to work better. We’ll help you understand the next step.

Discuss your project

Prefer email? [email protected]