.tip

Jul 17, 2026 · one of the small things

Pin GitHub Actions by commit digest, not tag

A tag can be moved. The March CI campaign force-pushed tags on a popular action, and every workflow that trusted @v1 ran the new code. A digest can't be moved.

uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

Dependabot and Renovate keep the digest up to date and the comment readable.

securityci

~/tips/today — 2026-10-19

~cat tips/today

Never build an index on a live table without CONCURRENTLY

postgresqlmigrations

A plain CREATE INDEX takes a lock that blocks every write to the table for the whole build. On a big table that means minutes of outage that look like a hung app.

CREATE INDEX CONCURRENTLY orders_customer_idx ON orders (customer_id);

It's slower and can't run inside a transaction, so you'll have to tell your migration tool. If it fails halfway, it leaves an invalid index behind, so check pg_index.indisvalid and drop it before you retry.

↵ open y yesterday l ls /tips

esc close