ci-cd
2 posts · all writing
Shift left became "run everything on every commit", which is why people turned it off
The idea was that feedback is cheaper the earlier it arrives. What got built was a pipeline that runs twelve scanners on every push, takes eleven minutes, and gets bypassed. The useful version is about latency and relevance, not about location.
Describe your app, not your scanners: one config for Trivy, Semgrep and Gitleaks
Security tooling breaks down at scale because teams wire up scanners instead of describing software. A declarative descriptor flips the model, and fixes the noise, the toil, and the cost.