https://kukie.tech/tags/ci/Recent content in Ci on HistoryHugoko-krThu, 22 Oct 2026 21:00:00 +0900https://kukie.tech/posts/kukie-infra-11/Thu, 22 Oct 2026 21:00:00 +0900https://kukie.tech/posts/kukie-infra-11/Three days after the self-hosted runner went live, the weak point it shipped with turned into an incident — terraform apply moved to a throwaway CodeBuild runner, a leftover review buffer re-posted one PR’s comment into later reviews, the fix that gives every job its own container with a registration token minted by a GitHub App, Claude Code baked into the image after the installer started returning 429, and the docker.sock risk that is still left.https://kukie.tech/posts/kukie-infra-09/Mon, 19 Oct 2026 19:00:00 +0900https://kukie.tech/posts/kukie-infra-09/Moving CI off GitHub-hosted runners after the organization ran out of included minutes — one spot EC2 instance with no inbound access, runners registered with a one-hour token sent over SSM, the key pair and long polling behind every job, the tools the image had to add back, why public repositories stay out, and the weak points that lead to the next post.https://kukie.tech/posts/kukie-infra-04/Wed, 14 Oct 2026 09:30:00 +0900https://kukie.tech/posts/kukie-infra-04/How a develop merge in each app repo becomes exactly one image in ECR — a role that can push to one repository only, a commit-SHA tag that never moves so the job checks before it builds, a build cache that silently never saved, and a digest a person still copies into the manifest by hand.