InfoQ Homepage Continuous Deployment Content on InfoQ
-
Spotify More Than Doubled Monthly Code Changes as AI Accelerated Development
Spotify reports that AI-assisted development more than doubled monthly merged changes, prompting a review of quality and reliability controls across its engineering organization. The company describes changes to testing, observability, rollback capacity, workload prioritization, and automated maintenance as it adapts to higher software change volume.
-
GitLab Vulnerability under Active Exploitation Enables Unauthenticated Data Exfiltration
CVE-2026-85706 is a critical GitLab path-traversal vulnerability that has moved beyond theoretical risk into confirmed exploitation. It affects self-managed GitLab CE/EE and could allow an unauthenticated remote attacker to read arbitrary files from the GitLab.
-
DoorDash’s Flux Runs 130,000 Engineering Tasks through Cloud-Based Agents
DoorDash has moved engineering agent workloads from developer laptops to its Flux cloud platform. The platform automated 130,000 engineering tasks in one month and supports more than 25,000 automated code reviews weekly. Flux uses isolated Firecracker microVMs, an MCP gateway, reusable playbooks, and multiple invocation surfaces to run agent workflows with scoped access and centralized auditing.
-
Behind the Scenes: Block 450 JVM Repositories into Monorepo to Reduce Dependency Drift
Block, Inc. describes migrating ~450 JVM repositories into a monorepo across Cash App and Square engineering to reduce dependency drift and coordination overhead. The system supports ~8,800 weekly builds with ~10 min p90 CI time. The approach improves cross-service changes, build visibility, and developer experience through dependency graph–based builds, selective CI, and custom IDE tooling.
-
How GitHub Is Securing Agentic Workflows in Modern CI CD Systems
GitHub detailed a defense-in-depth security architecture for agentic workflows in CI/CD pipelines, focusing on isolation, constrained execution, and auditability. The design aims to safely integrate autonomous AI agents while mitigating risks like prompt injection, privilege escalation, and unintended actions, using sandboxed environments, restricted permissions, and full execution traceability.
-
Dropbox Collaborates with GitHub to Reduce Monorepo Size from 87GB to 20GB
Dropbox reduced its backend monorepo from 87GB to 20GB by optimizing Git delta compression in collaboration with GitHub. The changes improved clone times, CI performance, and developer velocity, highlighting how repository storage inefficiencies can impact large-scale engineering workflows.
-
Slack Enhances Chef Infrastructure to Improve Safety and Reduce Blast Radius in Deployments
Slack's engineering team has published an in-depth look at recent improvements to its Chef-based configuration management system, aimed at making deployments safer and more resilient without disrupting existing workflows.
-
Grafana and GitLab Introduce Serverless CI/CD Observability Integration
In a move to streamline development workflows, Daniel Fritzgerald of GrafanaLabs has published a new open-source solution that links GitLab CI/CD events into Grafana's observability stack via a serverless architecture.
-
HashiCorp Warns Traditional Secret Scanning Tools are Falling behind
HashiCorp has issued a warning that traditional secret scanning tools are failing to keep up with the realities of modern software development. In a new blog post, the company argues that post-commit detection and brittle pattern matching leave dangerous gaps in coverage.
-
AWS Introduces M4 and M4 Pro Mac Instances for Faster Apple App Development
AWS has recently launched two new Mac instances (M4 and M4 Pro) built on Apple's latest M4 silicon. The new EC2 instances provide faster CPU performance, enhanced graphics, and increased memory for building iOS and macOS applications.
-
AWS CDK Refactor Feature: Safe Infrastructure as Code Renaming
AWS's new Cloud Development Kit (CDK) refactor command allows engineers to safely rename and reorganize infrastructure as code without forcing a destructive rebuild. The feature, leveraging a similar AWS CloudFormation capability, automatically computes the necessary mappings to preserve resources like databases, solving a major pain point that previously led to data loss and downtime.
-
Uber Shares Strategy for Controlling Risk in Monorepo Changes That Affect 3,000+ Microservices
Uber has published details on their approach to controlling rollouts of large-scale changes across monorepos that serve thousands of microservices, addressing one of the key challenges in continuous deployment at massive scale.
-
Google Veles is a New Open-Source Secret Scanner Powering GCP
Google Veles is a newly released open-source secret scanner, launched as part of Google's broader OSV-SCALIBR (Software Composition Analysis LIBRary) ecosystem. Veles integrates seamlessly with other OSV-SCALIBR tools and also powers secret scanning in Google Cloud, while remaining available as a standalone module.
-
AWS Lambda Adds Support for GitHub Actions
AWS has recently announced that AWS Lambda now supports GitHub Actions, providing a simplified way to deploy changes to Lambda functions using declarative configuration in GitHub Actions workflows. The new option supports both .zip file and container image deployments.
-
How Amazon Uses Guardrails in Software Development
Carlos Arguelles spoke about Amazon’s inflection points in engineering productivity at QCon San Francisco, where he explained that shift testing left can help catch issues early. He suggested using guardrails such as code reviews and coverage checks. Your repo strategy, monorepo or multirepo, will impact the guardrails that need to be in place.