Operations | Monitoring | ITSM | DevOps | Cloud

The latest News and Information on Continuous Integration and Development, and related technologies.

Policy-as-code vs. policy-as-documentation: The difference that matters

A documented policy only works if every engineer remembers it, every time, under deadline pressure. That's the gap policy-as-code closes. This video covers what that actually looks like in practice: The instructions don't change. What changes is whether something actually enforces them, or just hopes someone reads them.

The Evolution of JFrog AI Catalog: Your AI Control Plane for Agentic Development

In a single morning, a coding agent can pull an open-source model, connect to an unvetted MCP server, and execute a code-optimizing skill from the web. In the rush toward agentic automation, these AI assets quietly bypass traditional security reviews, creating new attack vectors across the software supply chain. Closing this blind spot has been the driving force behind the JFrog AI Catalog since its launch at swampUP 2025.

How to set up CircleCI with Cursor Origin

CircleCI now integrates with Cursor Origin, bringing scalable CI/CD to Origin-hosted repositories. In this demo, see how to connect an Origin repository to CircleCI, configure your pipeline triggers, run a build, and report CI status back to your Origin pull request. Already using CircleCI? Your existing.circleci/config.yml works as-is, with no Origin-specific CI syntax or separate config to maintain.

How to Use Claude Code with CircleCI to Fix Failed Builds

Give Claude Code direct access to CircleCI and let it diagnose failed builds, fix issues, and keep iterating until your pipeline is green. In this tutorial, we walk through how to connect Claude Code to CircleCI using the CircleCI CLI. You’ll see how Claude can read pipeline results, identify test failures, make fixes, trigger new builds, and monitor CircleCI without leaving the terminal.

How we made vulnerability fixes review-ready with Agentic Pipelines

Routine vulnerability fixes are rarely difficult in isolation. The interruption that they cause is the problem: pick up the ticket, trace the dependency, update the package or image, regenerate files, run the checks, open the pull request, then return after deployment to close the loop. That repeated handoff was a good candidate for automation with agentic pipelines. The goal was simple: start the day with a tested pull request instead of another ticket to pick up.

Introducing JFrog Preview: Getting New Capabilities Into Your Hands, Faster

TLDR: “Preview” isn’t a lightweight version of GA, and it isn’t a beta with a new name on it. It just changes the timing and access. You’ll see new JFrog capabilities the day they’re ready for real use, not the day they’re ready for a press release. We’re starting at swampUP 2026. As we know, AI has changed the speed of software development and delivery. Work that used to take three months now takes weeks.

Your SBOM is already out of date

MIT and Apache 2.0 are the easy licenses. Generally, they let you do what you want. Copyleft licenses are the ones that come back to ask questions later, especially once you're generating revenue off the component. This video covers why license compliance gets challenging, and what actually keeps it under control: The goal isn't avoiding open source. It's knowing what's actually in there before a license or a vulnerability surprises you.

The Cyber Resilience Act isn't just for hardware

There's a common assumption that the EU Cyber Resilience Act is a hardware and IoT manufacturer concern. Actually, it affects any SaaS company selling into the EU too, and that's a gap in awareness worth closing. This video covers what the CRA is actually there to do and what it means for your own software supply chain: Securing your customers' supply chain starts with being able to account for your own.