I've been speaking to recruiters recently about roles in my area.
Almost every set of interviews now has a live coding portion to it.

I've got an interview next week where I've been told I will be asked to live code. When asked what sort of coding, I was told - it could be writing Terraform, Python, writing a helm chart, kubernetes manifests. It will be random on the day.

I've individually done a lot of these. I've been writing Terraform for years, and I do Kubernetes manifests every single day.
However, I might not touch Terraform for months whilst I work on one project. Python might be even longer.

If tasked with a Terraform project, I'll look at some recent work I did, get a feel for it again, and I'm productive pretty quickly.
But just throw me into an interview, and have multiple engineers ask me to live code, and I feel like I would turn to jelly. I can't remember off the top of my head how to do a module for Terraform - give me a previous one I created, I can take it as a template and start rewriting it, looking up functions if I need new things.

Same for Kubernetes. I will take a deployment file and a svc I did for something in the past, copy and paste it into a new file and edit it to fit my new needs. Writing the document from scratch without documentation... I can't remember that for shit. Who does it afresh on every new service?

We often talk about securing the software supply chain in terms of application dependencies. For instance, pinning package versions, maintaining lockfiles, and auditing third-party libraries.

But what about the code that runs our CI/CD pipelines?

GitHub Actions workflows can execute third-party actions, and the security of those dependencies matters just as much when building and deploying software.

The introduction of workflow dependency lockfiles is an interesting step towards making CI/CD workflows more reproducible and secure.

I wrote about this recently, exploring why workflow lockfiles matter and how they fit into the broader software supply-chain security picture.

Read the article: https://amitmerchant.com/ci-pipeline-lockfile/

Curious how others are approaching dependency security in their CI/CD pipelines. Are you already pinning your actions and enforcing similar controls?