DEVOPS WEEKLY ISSUE #685 - 18th February 2024

Incident postmortems, Git best practices, tips for management open telemetry names and tools and posts on open source software supply chain security this week.

StackHawk sponsors Devops Weekly

[ICYMI] DAST is Dead! Long Live DAST! The Evolution of Dynamic API security Testing webinar is now available on YouTube. Watch on-demand here.
https://sthwk.com/long-live-dast-webinar

News

A post on how to write a good incident postmortem, focused on the importance of understanding context and on applying the 5 whys.
https://medium.com/@vincesackschen/writing-an-excellent-postmortem-8534409f6e0d

An interesting observation about teams banning the use of merge commits in Git, backend by data and with an explanation of why folks are doing so.
https://graphite.dev/blog/why-ban-merge-commits

A breakdown of modern web frameworks, from static site builders to full stack frameworks and simpler/faster alternatives.
https://dev.to/wasp/web-frameworks-we-are-most-excited-for-in-2024-4d15

The end of year report from the Open Source Software Security Initiative, a multi-stakeholder group focused on policy solutions to help improve the security of the open source software ecosystem.
https://whitehouse.gov/wp-content/uploads/2024/01/Securing-the-Open-Source-Software-Ecosystem-OS3I-End-of-Year-Report-MASTERCOPY.pdf

A look at OpenTelemetry’s Semantic Conventions which allow for a common naming scheme for traces that can be standardised across a codebase, libraries, and platforms.
https://www.honeycomb.io/blog/effective-trace-instrumentation-semantic-conventions

A little dated, but a good post on comparing the Serverless framework with CDK, and why you might prefer one over the other.
https://www.alexdebrie.com/posts/serverless-framework-vs-cdk/

Tools

Ortelius is a unified evidence store of supply chain data designed to simplify. It provides developers a coordinated view of who is using a service, its version, and inventory across all end-points.
https://ortelius.io/
https://github.com/ortelius/ortelius

Write your build configuration in C# with Nuke. Includes native integration into a variety of CI/CD tools as well, so no need to write additional YAML configuration.
https://nuke.build/
https://github.com/nuke-build/nuke