Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
YouTube Security VideosBuilding AMD Helios: Testing and Validating Rackscale AI Solutions(24.09.2026 um 17:30 Uhr)
Podcasts & Audio Briefings9to5Google: The Googlebook could do something insane.(24.09.2026 um 17:30 Uhr)
YouTube Security VideosBack to School Raspberry Pi Quiz! #bermonths #quiz #raspberrypi(24.09.2026 um 17:24 Uhr)
YouTube Security VideosPC-WELT: Endlich hat die 2. RTX 5090 Sinn - lokale KI auf HMX 6!(24.09.2026 um 17:30 Uhr)
Windows Tipps & SecurityuBlock Origin broke on Edge, so I finally quit the browser(24.09.2026 um 17:24 Uhr)
Windows Tipps & SecurityHMX 6: Wir müssen reden(24.09.2026 um 17:30 Uhr)
Windows Tipps & SecurityWinamp Community Update Project(24.09.2026 um 16:40 Uhr)
YouTube Security VideosBuilding AMD Helios: Testing and Validating Rackscale AI Solutions(24.09.2026 um 17:30 Uhr)
Podcasts & Audio Briefings9to5Google: The Googlebook could do something insane.(24.09.2026 um 17:30 Uhr)
YouTube Security VideosBack to School Raspberry Pi Quiz! #bermonths #quiz #raspberrypi(24.09.2026 um 17:24 Uhr)
YouTube Security VideosPC-WELT: Endlich hat die 2. RTX 5090 Sinn - lokale KI auf HMX 6!(24.09.2026 um 17:30 Uhr)
Windows Tipps & SecurityuBlock Origin broke on Edge, so I finally quit the browser(24.09.2026 um 17:24 Uhr)
Windows Tipps & SecurityHMX 6: Wir müssen reden(24.09.2026 um 17:30 Uhr)
Windows Tipps & SecurityWinamp Community Update Project(24.09.2026 um 16:40 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

From branches to trunk (a journey)

Preface In environments where people are used to using some sort of Gitflow variant, the norm is having main, develop, and long-lived feature branches. There are often not enough good automated tests and use-case coverage to deliver with…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!




Preface



In environments where people are used to using some sort of Gitflow variant, the norm is having main, develop, and long-lived feature branches. There are often not enough good automated tests and use-case coverage to deliver with confidence, so branch isolation and friction-creating processes are used to ensure some quality. At least having a DEV stage where builds get deployed after they successfully created a container image is the usual case. This doesn't mean there is an automated release process or additional stage for testing prior to a release, also known as merging into main.



This means the DEV stage can be a moving target for testers, if the first stable stage is the INT stage, where Releases (2 weeks of work) are deployed for delivery towards production. Here, the testing works on a fixed set of features and stable servers, without the surprises of new features popping up when something is merged.



Since Releases happen every 2 weeks, people can be eager to merge instead of waiting another 2 weeks when they are nearly but not yet done, especially clients and project managers, who can get restless. So we get bugs that get caught on INT, and then we need to create hotfixes and test again. If there were merges in between, the fix needs to be cherry-picked, which means the hotfixed Release isn't the same set of features as the current develop branch.






Current setup



Delivery Stages




  • DEV (develop) - develop branch gets deployed after merge (build takes hours)

  • INT (Integration) - main branch gets deployed every 2 weeks after release build

  • ...

  • PROD (Production) - gets deployed 2 weeks after INT



This means the state on INT is not the same; if errors occur, we need to have a hotfix, and this means more friction.

The often-used solution is to have a merge-freeze on develop until Release, to ensure everything on DEV gets tested. So main in the end is the Release branch and has no other function. You could also tag a commit in develop and release that without going through the motions of PRs from develop to main, which is done by hand; this is cumbersome and creates a lot of friction and therefore waste.



A new idea is to have a TST (testing) stage, so that a fixed set can be tested and released.






New setup



Delivery Stages




  • DEV (develop) - develop branch gets deployed after merge (build still needs hours)

  • TST (testing) - a fixed state of develop can be tested and then merged into main

  • INT (Integration) - main branch gets deployed every 2 weeks after release build

  • ...

  • PROD (Production) - gets deployed 2 weeks after INT



Question: How do we get the tested commits into main after new merges into develop?

Answer: More branches!






Branches everywhere?



So now we have develop and main as branches with the new setup, we need to branch from develop with a certain set of commits to merge into main.

One way could be to create a new branch from develop and merge into main, so that we still have PRs and manual actions and waste.

Instead, we could tag a commit and merge the tag into main, which we can do by hand or we can automate.






Moving towards trunk!



Question: If we do this, do we really need main anymore?

Answer: I think not.



Question: Could we instead work and release only develop?

Answer: Yes, let's call it trunk instead of develop.



We could tag a commit in develop and release the tagged commits, that way we don't need an extra branch and manual motions to get the commits into it. Less manual work and friction, less waste.

Depending on your view, we could call it successfully moving towards trunk-based development.



What do you think? Let me know in the comments.



For me next stop in the journey is moving towards continuous delivery :)

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
SOC Incident Playbook: Vulnerability Remediation & Verification
title: Detect Exploitation - From branches to trunk (a journey)
id: d7ba79ae-8314-4073-b956-ea55cd30a869
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "From branches to trunk (a jour" ascii wide
    condition:
        any of them
}
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich From branches to trunk (a journey).... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten From branches to trunk (a journey)

Thematisch verwandte Begriffe: From, branches, trunk, journey · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-81549 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authent…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...
↗ Original-Quelle