When security incidents happen, it’s crucial for software providers and users alike to take swift and effective action. In response to our recent security incident, we witnessed firsthand how an open and collaborative effort between our customers, technology partners, and engineering teams helped to contain the threat and mitigate risk of unauthorized access to customer systems.
Well-designed secrets management is a delicate balancing act between security and usability. Secrets must be easily accessible to the right users when building and deploying, but they must also at the same time be well-secured and easy to rotate. This article will cover how to thread this needle by integrating CircleCI with HashiCorp Vault and retrieving secrets using short-lived OpenID Connect (OIDC) authentication tokens.
Welcome to the DevSecOps and CI/CD security guide. Browse through each section to discover various relevant resources to ensure security of your applications and infrastructure.
On January 4, 2023, we alerted customers to a security incident. Today, we want to share with you what happened, what we’ve learned, and what our plans are to continuously improve our security posture for the future.
Continuous integration and delivery (CI/CD) optimizes team development flows by automating build, test, and deployment processes to ensure fast and reliable delivery of high-quality software. Adopting best-in-class CI/CD tooling is one of the best investments your organization can make to shorten delivery cycles, eliminate painful manual processes, and keep infrastructure costs in check.
Platform engineering is an emerging discipline focused on enhancing developer productivity by reducing the complexity and uncertainty of modern software delivery. It addresses some of the biggest challenges of doing DevOps at scale, including aligning development practices with business priorities and reducing the burden of managing a complicated web of tools and infrastructure across the application lifecycle.
There are hundreds of capabilities on CircleCI that were designed to create the best possible CI/CD experience for our users. But one feature that users often point to as the most valuable on the platform is the CircleCI Insights dashboard. The Insights dashboard provides full visibility into metrics like job status, duration monitoring, and solutions for pipeline optimization.
Components are reusable bits of code that, most of the time, work and function independently. If you want to be confident that components are working properly, you need to test them. Conveniently, Cypress.io has designed their testing framework to include component testing. This tutorial illustrates the differences between end-to-end (E2E) and component testing, and what to consider when using these methods. Then, you will learn how to use Cypress for component testing.
Earlier this year, CircleCI added GitLab as the third version control system that we support, in addition to GitHub and Bitbucket. At CircleCI, it’s vital that we meet our users where they are, and many of our users are on GitLab. We were happy to make it possible for our users to build, test, and deploy via the GitLab platform.
When it comes to building RESTful APIs, PHP’s open source Laravel framework remains a top 5 backend framework for web development. Laravel also makes testing your API endpoints a breeze by providing an easy-to-use testing suite. In this post, we will build a token-based authentication API with Laravel, write tests for the endpoints, and automate the build and testing process with CircleCI.
