CircleCI has released a new feature called CircleCI runner. The runner feature augments and extends the CircleCI platform capabilities and enables developers to diversify their build/workload environments. Diversifying build environments satisfies some of the specific edge cases mentioned in our CircleCI runner announcement.

“Serverless computing is a cloud-computing execution model in which the cloud provider runs the server, and dynamically manages the allocation of machine resources. Pricing is based on the actual amount of resources consumed by an application.” — “Serverless Computing”, Wikipedia This mundane description of serverless is perhaps an understatement of one of the major shifts in recent years.

When you choose a product, you’re hiring it to do a job. You’ve put out the“Help Wanted” sign for DevOps, and choosing between two well-qualified prospects is high stakes. The hire you make can ensure the enterprise swiftly rises — or sinks. With JFrog and GitHub, you have two of the best candidates. Now judge which is the best fit. Beyond the puzzle of competing features, which one knows how best to get the job done?

NeuraLegion’s VP Oliver Moradov takes us through how you can use JFrog and NeuraLegion to automate AppSec testing in your pipelines. The days of long release cycles are well and truly behind us — it is simply not feasible in our agile development world, with developers delivering software and more features at an unprecedented scale and speed. With DevOps, we have multiple development teams running multiple concurrent builds, which is great, but security testing has not kept up.

If you are using a CI/CD tool, you likely are already familiar with workflows. Generally, workflows are a set of tasks, activities or processes that happen within a specific order. Within Codefresh, a popular workflow is to trigger Codefresh pipelines from Docker image push events. This moves the workflow forward from Continuous Integration to Continuous Deployment. Images can be promoted from one environment to the other through a variety of ways.

After getting a taste of DevOps’ benefits, enterprises naturally seek to widen its adoption. However, the tooling and processes that work for small-scale use cases often fall short when teams try to scale DevOps efforts. You must support all your different teams, toolsets, applications, processes, workflows, release cycles and pipelines — both legacy and cloud native.

Building containers securely, reliably, and consistently at scale is a daunting task. Yet, it’s an imperative for organizations embracing the rapid delivery of high-quality software. This is the scenario addressed by VMware Tanzu Build Service, which can help any enterprise IT group build and update containers automatically. And it’s flexible enough to slot right into any incumbent CI/CD toolchain.

Code analysis tools are essential to gain an overview and understanding of the quality of your code. This post is going to cover the following While these tools target similar use cases, they differ in their implementation, ease of use, and documentation just to name a few. This post provides an overview of each tool as well as a detailed comparison to help analyse and decide which tool is best suited for your needs.

Choosing a software solution means checking the right boxes, and being “cloud native” has bubbled to the top of most lists. But cloud native is a box built of boxes of its own. For a CI/CD solution like JFrog Pipelines, cloud native starts by being “born in the cloud” to natively execute in, build for, test in, and deploy to cloud computing environments. But what boxes does a CI/CD solution really need to tick to complete that larger cloud native box?

The npm Registry is vulnerable for supply chain impersonation attacks. Make sure you create npm scoped packages and force exclude patterns.