Findings · Updated 2026-10-29
Repositories of practical value
Selected by task, documentation, tests and maintenance — not by stars.
Selection · 2026-10-29
20 repositories → 18 practices across four tracks: DevOps, Platform Engineering / DevSecOps, MLOps / LLMOps and AI tools for engineers. Ansible-lint with Molecule and promptfoo with garak are merged.
P1 — immediately useful for the VPS and GitLab CE; P2 — when the matching CI, LLM workload or security tasks exist; P3 — the next step on the career track.
Trivy: pin the image by digest
In March 2026 Trivy was compromised: the malicious v0.69.4 release, images v0.69.5–v0.69.6 and rewritten trivy-action and setup-trivy tags. Through an unpinned Trivy in the LiteLLM project's CI, a publishing token was stolen, and malicious litellm 1.82.7 and 1.82.8 were published to PyPI. The Trivy in CI practice: image by digest only, no latest. Sources: CSA, SafeDep, Snyk.
What to work through next
- Renovate: a scheduled pipeline in GitLab CE, images by digest, one update group per week.
- gitlab-ci-local: run the pipeline locally before push.
- Scorecard: assess the security and maintenance of the repositories in the selections.
- agent-scan: check every skill and MCP server before installing.
AI tool catalogs
- agency-agents — role scaffolds for subagents, not proven practices: CI checks the form, not the behavior.
- awesome-ai-plugins — only for finding candidates: trust scores are assigned by the catalog owner's own scanner, and some entries are its own products.
Selection · 2026-10-11
12 repositories → 11 practices: Actionlint and ShellCheck are merged into one. All practices in this selection are not studied yet.
P1 — useful for the current VPS; P2 — when the matching CI, Kubernetes or security tasks exist; P3 — the next review once requirements are defined.
| Priority | Track | Repository | What to put to work | Status |
|---|---|---|---|---|
| P1 | DevOps | restic/restic | Restoring VPS data | Not studied |
| P1 | DevOps | healthchecks/healthchecks | Detecting a missed cron job | Not studied |
| P1 | DevOps | prometheus/blackbox_exporter | Checking the site and TLS | Not studied |
| P1 | DevOps | goss-org/goss | VPS acceptance after changes | Not studied |
| P2 | DevOps | rhysd/actionlint | Checking GitHub Actions | Not studied |
| P2 | DevOps | koalaman/shellcheck | Checking shell scripts | Not studied |
| P2 | DevOps | yannh/kubeconform | Checking Kubernetes YAML | Not studied |
| P2 | Platform/DevSecOps | anchore/syft | Image component inventory | Not studied |
| P2 | Platform/DevSecOps | getsops/sops | Encrypted configs in Git | Not studied |
| P3 | Platform/DevSecOps | open-policy-agent/conftest | Configuration policies | Not studied |
| P3 | DevOps | slok/sloth | SLOs and error budget burn | Not studied |
| P3 | Platform/DevSecOps | sigstore/cosign | Verifying image provenance | Not studied |
What to work through next
- Conftest: one configuration policy with positive/negative tests.
- Sloth: one SLO, verified SLIs and error budget burn rules.
- Cosign: verify the signature against a trusted identity/issuer or key and the image digest.
Archive · 2026-04-15
| Priority | Track | Repository | What to put to work | Status |
|---|---|---|---|---|
| — | DevOps | kamranahmedse/developer-roadmap | A map of DevOps areas and gaps | Studied |
| — | DevOps | trimstray/the-book-of-secret-knowledge | Linux diagnostics, networking and hardening | Studied |
| — | DevOps | bregman-arie/devops-exercises | Hands-on exercises and worked problems | Studied |
| — | DevOps | binhnguyennus/awesome-scalability | Reliability and scaling | Studied |
| — | DevOps | kelseyhightower/kubernetes-the-hard-way | How Kubernetes works | Studied |
| — | DevOps | veggiemonk/awesome-docker | Docker tools and practices | Studied |
| — | DevOps | MichaelCade/90DaysOfDevOps | A step-by-step learning program | Studied |
| — | DevOps | ramitsurana/awesome-kubernetes | Navigating the Kubernetes ecosystem | Studied |
| — | DevOps | dastergon/awesome-sre | SRE, SLOs and incident handling | Studied |
| — | DevOps | bregman-arie/devops-resources | Additional DevOps materials | Studied |