# engineering-practice Published articles for engineering-practice. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## How mature is your autonomous software development? DevFeed: [How mature is your autonomous software development?]() Original publisher: [Read original article]() Author: Matar Peles Published: 2026-08-10T11:32:44Z Content type: article Language: en Sources: [Developer Experience & Platform Engineering Blog | Port]() Topics: [AI Development](), [Software Engineering](), [software-development](), [pull-requests]() Tags: [ai](), [ai-agents](), [autonomous](), [code](), [developer](), [development](), [engineering](), [engineering-practice](), [governance](), [production](), [pull-request](), [software-development](), [validation]() ### AI overview This quiz assesses a team's maturity in autonomous software development across AI maturity, velocity, and governance. It describes how AI agents can independently consume context, write code, run validation tests, and open pull requests under platform-level policies, then places teams into five profiles ranging from largely manual work to fast, well-governed agent use. ### Source excerpt Take the quiz to find your stage in AI driven development, and see what's missing for your team to become AI native. ## Bringing full YAML anchor support to zizmor DevFeed: [Bringing full YAML anchor support to zizmor]() Original publisher: [Read original article]() Author: "Alexis Challande" Published: 2026-05-22T11:00:00Z Content type: article Language: en Sources: [The Trail of Bits Blog](), [The Trail of Bits Blog]() Topics: [GitHub Actions](), [YAML](), [GitHub](), [ci](), [BigQuery](), [bug](), [Open Source](), [dataset]() Tags: [backdoor](), [bigquery](), [bug](), [bugs](), [ci](), [ecosystem-security](), [engineering-practice](), [github](), [github-actions](), [open-source](), [post-mortem](), [pull-requests](), [secrets](), [supply-chain](), [testing]() ### AI overview Trail of Bits describes how it collaborated with zizmor maintainers to add full YAML anchor support to the GitHub Actions static analyzer. The work fixed parsing and deserialization issues, aligned expression evaluation with GitHub's tests, and was validated against 41,253 workflows from 6,612 open-source repositories. ### Source excerpt In March 2026, attackers exploited a pull_request_target misconfiguration in the aquasecurity/trivy-action GitHub Action to exfiltrate organization and repository secrets, then used those credentials to backdoor LiteLLM on PyPI (see Trivy's post-mortem for the full timeline). zizmor is a static analyzer that GitHub Actions users run to catch exactly these misconfigurations before they ship. When GitHub Actions added support for YAML anchors in September 2025, a small but high-value slice of the ecosystem started writing workflows that zizmor could only analyze on a best-effort basis. Over the past three months, Trail of Bits collaborated with the zizmor maintainers to bring zizmor's anchor support up to full coverage. First, we fixed parsing bugs that caused crashes, produced wrong-location findings, and silently mishandled aliased values. Second, we surfaced deserialization edge cases that broke zizmor on otherwise valid workflows. Finally, we helped align zizmor's expression evaluator with GitHub's own Known Answer Tests. We validated all of this against a new corpus of 41,253 workflows from 6,612 high-value open-source repositories. The result: 20 filed issues, 15 merged pull requests. Building the test corpus To understand how anchors are used in CI today and to stress-test zizmor against the full variety of YAML it encounters in the wild, we built a corpus of real workflows. We used BigQuery's GitHub dataset to identify the 10,000 most-starred repositories created between 2022 and 2025, filtered to the 6,612 that use GitHub Actions, and downloaded every workflow file. That gave us 41,253 YAML files. Figure 1: Building a testing corpus When we ran zizmor against the corpus, it crashed on 45 of the 41,253 workflows. That's a low rate, but each crash means a bug in zizmor. How anchors are used in the wild zizmor's anchor support was deliberately limited, and for good reason. YAML anchors make workflows non-local: an alias defined in one place changes behavior else ## Performance engineering as a habit, not a project DevFeed: [Performance engineering as a habit, not a project]() Original publisher: [Read original article]() Author: fidelitas.io Published: 2026-05-16T16:00:00Z Content type: tutorial Language: en Sources: [fidelitas.io]() Topics: [Benchmark](), [ci](), [Code](), [systems]() Tags: [benchmark](), [benchmarks](), [build](), [ci](), [cloud](), [code-review](), [engineering-practice](), [git](), [hardware](), [latency](), [observability](), [performance](), [performance-engineering](), [regression](), [runner](), [slo]() ### AI overview The article argues that teams should treat performance engineering as a recurring engineering habit rather than a temporary project. It recommends measuring every pull request, comparing results with the previous day, and making performance regressions fail the build as part of CI. ### Source excerpt Most performance work is reactive: the bill goes up, the dashboard turns red, somebody opens an investigation ticket. Here's how to make it boring instead.