Ci-Cd on Daffa Abhipraya

PPL: Quality Gates That Actually Block Bad Code

Thu, 09 Apr 2026 00:00:00 +0700

Quality tools are useless if they are not enforced. Our project had SonarQube analyzing every commit, schema fuzzing running against our API, and load tests measuring latency, but every single one of them was set to allow_failure: true. Violations were silently ignored, real bugs slipped through, and nobody noticed because the pipeline was always green. This blog covers how we turned those advisory checks into blocking gates, built automated CI reporting so reviewers could actually see the results, and watched the tools catch a JWT vulnerability, a production crash, and 31 code quality violations that had been accumulating for weeks.

PPL: When 91% Test Coverage Means Nothing

Sun, 15 Mar 2026 00:00:00 +0700

We had 91% line coverage and felt good about it. Then we ran mutation testing and scored 0%. Every line of our service layer was executed by tests; almost nothing was actually verified. This is the story of how six advanced testing tools exposed the gap between “code was run” and “code was checked,” and what that means for any team relying on coverage as a quality signal.

Note: Our project is hosted on an internal GitLab instance, so we use the term MR (Merge Request) throughout this blog. If you’re coming from GitHub, MRs are the equivalent of Pull Requests (PRs).

PPL: Development Discipline [Sprint 1, Week 3]

Fri, 13 Mar 2026 00:00:00 +0700

What I Worked On

Sprint 1 Week 3 was the highest-output week of the project so far. I authored and merged 14 merge requests covering full-stack features, CI/CD pipeline improvements, production infrastructure fixes, and data integrity patches.

MR Summary

MR	Type	Title	Date
!20	feat	Layout, navigation & dashboard (full stack)	Mar 7
!47	feat	Seed production admin and staff users with Nashta emails	Mar 7
!12	feat	Invoice management (full stack)	Mar 8
!54	feat	Add Payments link to sidebar navigation	Mar 8
!66	fix	Rename out-of-order migration timestamps to unblock CI deploy	Mar 9
!67	feat	Add migration dry-run validation to MR pipelines	Mar 9
!68	fix	Add missing ENCRYPTION_KEY to deploy env generation	Mar 9
!71	fix	Add proxy-headers to uvicorn for HTTPS redirect support	Mar 10
!74	chore	Add Conductor workspace support	Mar 11
!76	fix	Resolve invoice seeder subquery returning multiple rows	Mar 11
!77	fix	Deduplicate invoice numbers in seed CSV	Mar 11
!78	fix	Polish sidebar, header, profile edit, and invoices page consistency	Mar 11
!79	fix	Remove sidebar header bottom border	Mar 11
!17	feat	Client management (full stack, merged by me)	Mar 9

Breakdown by category

Full-stack features: 4 MRs (!20, !12, !54, !17)
CI/CD pipeline: 3 MRs (!66, !67, !68)
Infrastructure: 2 MRs (!71, !74)
Data integrity: 3 MRs (!47, !76, !77)
UI polish: 2 MRs (!78, !79)

Commit Message Quality

Every commit follows the conventional commits format: type(scope): description. The scope tells you exactly which app/layer is affected, and the description is specific enough to understand the change without reading the diff.

PPL: Building a Production-Safe Migration Pipeline with Automated Rollback

Thu, 12 Mar 2026 00:00:00 +0700

Why Database Migrations Need Safety Nets

Imagine this scenario: a developer adds a new column to the invoices table, pushes to main, and the CI/CD pipeline deploys it to production. Everything looks fine until the next morning, when the team discovers that the migration also dropped a constraint that was silently relied on by another service. Rolling back means manually writing SQL against the production database at 2 AM.

PPL: Building an Integrated Tool Ecosystem for a 9-Person University Team

Thu, 12 Mar 2026 00:00:00 +0700

Why Tooling Is a Team Problem, Not a DevOps Problem

Most university software engineering courses teach you which tools to use (Git for version control, Jira for tickets, Docker for deployment). What they rarely teach is how tools interact with each other, and what happens when they don’t.

In a professional environment, a single commit can trigger a cascade: CI runs tests, a Slack bot notifies the team, a coverage report lands in SonarQube, and the ticket moves to “In Review” on the project board. This doesn’t happen by accident. Someone has to build that integration layer, and in a university team, that someone is usually whoever cares enough about developer experience to do it.

Ci-Cd on Daffa Abhipraya

PPL: Quality Gates That Actually Block Bad Code

PPL: When 91% Test Coverage Means Nothing

PPL: Development Discipline [Sprint 1, Week 3]

# What I Worked On

# MR Summary

# Breakdown by category

# Commit Message Quality