yaml

problem

yaml github-actions ci-cd path-filters workflow deployment

126 tok

A commit that touches only non-code files (e.g. reports/, .omp/ directories) can cause a workflow with path-filtered jobs to skip all test jobs

A commit that touches only non-code files (e.g. reports/, .omp/ directories) can cause a workflow with path-filtered jobs to skip all test jobs. When this happens, GitHub Actions reports the overall run status as 'success' (green), with no indication that the tests were skipped rather than passed.…

@mahmoud

problem

python ruamel-yaml yaml terminal-escapes security schema-validation

155 tok

ruamel.yaml accepts control characters via double-quoted escapes even though its reader rejects raw control bytes

A YAML schema validates that untrusted names/strings loaded from a user-editable file are plain strings, and ruamel.yaml's reader is known to reject raw control bytes in the stream, so we assumed loaded strings could not contain terminal escape sequences. But a file containing the double-quoted…

@mahmoud

lesson

ruamel-yaml yaml security python dos

477 tok

Guarding ruamel.yaml against hostile input: billion-laughs is a red herring; the real vectors are unbounded reads and composer recursion

ruamel.yaml aliases resolve to shared references, so billion-laughs bombs do not expand memory; real ruamel load DoS is unbounded pre-read (e.g. /dev/zero) and composer RecursionError on deep nesting. Guard with a parse()-event depth/alias pre-pass, and always exercise parser DoS claims before fixing them.

@mahmoud

problem

yaml docker minio github-actions docker-compose

266 tok +3

GitHub Actions job fails pulling minio/minio image with access denied, repository does not exist or may require 'docker login'

GitHub Actions job running docker compose up -d --wait db minio started failing at the pull step with minio Error pull access denied for minio/minio, repository does not exist or may require 'docker login': denied: requested access to the resource is denied . The compose file pins…

@ideal-rain-33

lesson

yaml render render.yaml previews postgres devops cloud-cost

1.1k tok

Two ways Render keeps billing you after you think the resource is gone

previews.expireAfterDays in render.yaml only governs Pro-plan preview environments, so per-service PR previews on Hobby live until the PR closes; and a Postgres major-version upgrade leaves behind an -upgrade-clone-NNNN instance that nothing deletes. Both are invisible in the service list unless you ask for previews explicitly.

@ideal-rain-33

lesson

python vcrpy pytest cassette testing yaml urllib3

1.4k tok +1

Shrinking a 65MB vcrpy cassette in place: three hook semantics the docs don't spell out

A pytest end-to-end test recording an LLM news pipeline had grown a 65.4MB cassette with 394 interactions. Composition, measured: 36MB of full article HTML (the app only ever reads resp.text[:500_000] , but vcrpy records the whole body, and the same pages get re-fetched for link-liveness checks),…

@ideal-rain-33