Decisions, and what each one cost

The reader of these templates has one machine, no platform team, and a service to stand up this afternoon. Kubernetes answers a question they do not have and adds a control plane they would have to run. The upstream project's own compose file usually answers a different question again: it gets the developer running, with a floating tag and no certificate.

A tag is a promise made by someone else. stable moved under three templates in one week, and a deployment that worked on Monday pulled something different on Thursday with the same file. The alternative, floating tags with a note to check upstream, is what every other example repository ships.

An action referenced by tag can be replaced under that tag by whoever holds the upstream repository, and it runs with this repository's token. Pinning by SHA closes that and opens another problem: a pinned SHA never moves on its own, so it goes stale in silence. Ungrouped, a week in which four actions publish is four pull requests per repository, and across ninety repositories that is a queue nobody reads to the end.

Every template had taken backups for years. Whether the archive contained what an operator would need on the day was a belief: tar exits 0 over a directory that is missing half its files, and a database dump that opens is not a database dump that restores.

gh pr merge --auto hands the decision to GitHub, which waits for the checks a branch rule marks as required. Where no rule marks any, nothing is required, and auto-merge merges immediately, before the verification it was meant to wait for. That is exactly the state of a fleet that refuses required checks on purpose.

A game server crashed and Docker reported it healthy for seventeen hours. The health check searched for the process with pgrep -f, which matches its own command line, so it had never failed and never could. A check that cannot go red is a green light wired to the wall.

Three jobs in the operations repository ask a model for judgement: what upstream changed between two versions, what is worth adding to the fleet, and what the home servers learned this week. An API key in a repository secret is a key that any workflow in that repository, present or future, can spend, and that a leaked log can spend from anywhere.

Reading a catalogue of self-hosted software and generating a compose file for each entry is a week's work for an agent, and the result would be ninety repositories nobody had run. The value of a template here is what running it taught, and that cannot be generated.

GitHub disables a scheduled workflow after sixty days without a push. No run fails, no badge turns red, and the last green run stays on the README. A daily job that fails daily looks, to a check that counts successes, exactly like a job that stopped.

Actions mail is switched off across the fleet: at ninety repositories it is a hundred messages a week that say the same thing, and a hundred messages nobody reads are the same as none. A report that opens a new issue every day is a report that gets muted the same way.

The heartbeat could not read eleven private repositories, and in one of them two Dependabot pull requests had sat four and seven days, one of them green and mergeable the whole time. The quick fix was to add those repositories to the token the fleet already held.

The end-to-end test restored with its own commands, and passed. The scripts a person would run on the day were never executed by anything. Four had been written for a different vendor's image, one refused to run, one signed in with the wrong account, and several merged the backup into live data instead of replacing it. In sixteen templates the script was more than three years old.

Pin Freshness ran inside Deployment Verification. It is a designed alarm and goes red when a pin is one version behind, which triage fixes within the day. Measured over fourteen days across the fleet, nine red runs in ten were this alarm and nothing else, and a visitor cannot tell one version behind from does not boot.

A restore test that runs on the host that took the backup answers an easier question than the one a security questionnaire asks. The questionnaire asks how long until it works again after the host is gone, and whether the backup taken under last month's release restores into this month's.

The profile said 72 restore scripts across 47 templates on the day that was true, and would have said it for a year. A number a person typed is a number that is wrong from the next release on.

OpenSSF Scorecard, read across all 97 public repositories, scored Branch-Protection 0 on 91 of them: main could be rewritten or deleted by anyone holding the token, and nothing would have noticed until a clone came back different. The full answer, required reviews and required checks, assumes a second reviewer this fleet does not have, and a rule that would be bypassed on day one is worse than none.

A tag is a name, and a name can be moved. Across 833 tags nothing a person deployed could be checked against anything: no archive, no signature, no statement of how it was built. Scorecard marked Signed-Releases as not applicable for the whole fleet, which is the polite form of zero. The keyed alternative, a GPG key in a repository secret, is a key every workflow in that repository can use and a leaked log can use from anywhere.