Author: Matt Saunders

Cloud-based web development service Wix has written about a new approach to integrating artificial intelligence into continuous integration and continuous deployment (CI/CD) systems. In a blog post, Wix demonstrates how probabilistic AI can coexist with deterministic development processes, adding chaos without compromising reliability.

In the post, Wix’s Mobile Release Engineering team explains how they successfully implemented AI tools within their CI/CD infrastructure to use AI’s learning capabilities without undermining the predictability that CI/CD systems require. They make it clear that their use of AI is to augment human decision-making rather than replace automated processes.

Itai Schuftan, who leads the Mobile Release Engineering team, explains that the key insight was recognising that not every aspect of CI/CD needs to be deterministic. Whilst builds and deployments must remain bulletproof, tasks such as interpreting logs, triaging errors, and recommending fixes operate in grey areas where AI’s pattern recognition excels.

When it came to CI/CD, almost no one was going near it. Maybe for good reason — it’s a hard, unforgiving space where the margin for error is tiny. But my manager truly believed this was worth exploring. That there had to be a way to combine AI’s growing capabilities with the world of build pipelines and mobile tooling.

Wix was careful to ensure that boundaries were not overstepped, and AI is not used to trigger deployments or make critical infrastructure decisions. Instead, it guides the humans who do, making them more efficient and reducing the cognitive load of managing complex build systems.

One of Wix’s most successful AI implementations addresses analysing build logs, a persistent pain point for DevOps teams. Traditional build logs are lengthy, noisy, and inconsistent across platforms, often burying critical error information amongst dependency warnings and cryptic stack traces.

Wix deployed their internal AI assistant to parse these logs systematically, identifying actual errors rather than simply flagging the first problematic line. The system highlights key issues, attempts to explain them in plain language, and suggests potential solutions. This has reportedly saved hours of back-and-forth communication each week between developers and infrastructure teams.

This has also allowed developers to work more autonomously, as previously, many build failures required developers to contact DevOps engineers for help, creating a bottleneck and interrupting their work. The  AI-powered log analysis frequently lets developers understand and resolve issues independently.

Similar approaches are being adopted across the industry. For example, Datadog’s AI-driven monitoring capabilities interpret logs in real time, highlighting errors and diagnosing root causes with plain-language explanations. Their system also has predictive failure analysis and can automatically restart failed services or roll back to stable versions, minimising downtime in production environments.

Wix has implemented Model Context Protocol (MCP), a specification that provides structured context to large language models before processing queries. The MCP server gives context to the AI by supplying build logs, module metadata, and relevant documentation. Connecting the AI to the MCP server lets the system narrow down faults, find where they occurred, and often correctly identify the affected module. The benefits are more accurate summaries, better root cause detection and actionable next steps.

Levelling up the AI by adding aid from MCP to understand domain context has allowed Wix to reduce the verbosity needed to prompt the AI and the hand-holding required in a more generic AI approach. 

MCP shifted us from ‘AI assistant’ to ‘AI teammate.’ It no longer needs hand-holding or verbose prompts — it just gets it.

Wix has also developed an automated migration system that addresses code degradation across its mobile applications, which can be very complex and consist of dozens of subprojects. The migration system uses static analysis, heuristics, and LLM capabilities to identify and update relevant module code while suggesting tailored fixes. The migration framework understands specific module contexts, including dependencies, code style, and project settings, and avoids applying generic updates. It generates pull requests with proposed migrations and explanations of changes, allowing migration owners to approve, modify, or reject suggestions.

This system has dramatically improved migration timelines. Wix reports that migrations previously requiring up to three months can now be completed across 100 modules within 24-48 hours, whilst maintaining code quality through human oversight.

The success reflects broader industry adoption of AI-powered migration tools. Sourcegraph’s AI code intelligence drives automated migrations for organisations including Reddit and FactSet, reportedly improving migration speed and reducing bugs by up to 60%.  Google uses similar strategies in its generative AI-powered workflows for automated code migrations. It allows AI to autonomously produce verified code changes that pass unit tests, with human engineers retaining approval controls. Google’s implementation has reportedly accelerated migration workflows and cut overall migration time by up to 50% while maintaining code stability and auditability through human oversight.

Carefully and thoughtfully adding AI to their CI/CD pipelines has produced measurable improvements in system stability and developer experience at Wix. By introducing controlled non-determinism in appropriate areas, the CI/CD process has become more stable, predictable, and user-friendly. Wix attributes this success to clearly defining boundaries and keeping human oversight where it’s needed. This methodology is gaining traction across the technology industry. Healthcare platforms like Epic and Meditech use deterministic AI agents embedded in CI/CD pipelines for secure, explainable validation and deployment workflows, prioritising reproducibility and compliance requirements.

Schuftan closes out the blog piece by pointing out that they are still iteratively improving when they use the new AI-enabled tools, using them to find and fix bottlenecks and repetitive tasks.

The irony is: by introducing a bit of non-determinism in the right places, we’ve made our CI/CD process feel more stable, more predictable, and way more human-friendly.

HashiCorp’s 2024 State of Cloud Strategy Survey, conducted by Forrester Consulting, provides critical insights into cloud adoption and maturity among global enterprises. The study surveyed nearly 1,200 organisations, revealing a significant disparity in cloud maturity levels, with only 8% of respondents qualifying as highly cloud mature.

The key findings from Forrester show that high-maturity organisations focus on strategy and scaling. They establish platform teams and adopt internal developer platforms (IDPs) while standardising security and compliance practices across their entire digital estate. They are significantly more likely to align their cloud infrastructure strategy with overall business goals, strengthen security, reduce risk, and simplify compliance.

In contrast, low-maturity firms prioritise tactical considerations. They appear more focused on budgets and bottom lines. Forrester notes this as concerning, indicating that these organisations are paying more attention to short-term cost-cutting than long-term strategy.

The need for essential cloud skills is particularly problematic for low-maturity firms. This shortage creates challenges in many areas, especially in cloud security.

Despite being in its early stages, many respondents believe Generative AI can help address critical cloud issues such as security, skills, availability, and scalability. Organisations are beginning to investigate how to use AI to bolster their cloud infrastructure and security efforts.

Forrester goes on to make several recommendations.

Invest in upskilling: Organisations should prioritise investment in modernising practices like the centralised use of infrastructure as code. Addressing skills gaps through training in cloud, cybersecurity, and GenAI applications is crucial. This approach can attract skilled developers enticed by the promise of working in a modern development environment.

Enhance multi-cloud and hybrid cloud strategy: Forrester advises embedding flexibility into cloud solutions to address specific organisational needs while promoting scalability, improving security, and optimising costs.

Implement cloud cost optimisation practices: to tackle the challenge of avoidable cloud spend (cloud waste), Forrester recommends implementing cloud usage audits, auto-scaling, and leveraging cost management tools. Spreading cost awareness and responsibility across teams can also help reduce cloud waste.

Strengthen security measures: As security remains a top priority across all levels of cloud maturity, organisations should solidify their security posture with advanced threat-detection systems, data encryption, regular security assessments, and ensuring staff is up to date on security best practices.

Carefully roll out GenAI for automation and innovation: While encouraging GenAI technologies to alleviate staffing issues and enhance security, Forrester advises caution. Organisations should make it a strategic objective to train or customise AI to their specific environment to help address skill gaps. However, the study advises against going all-in on AI too soon, noting that current AI solutions may only be ready for some use cases.

While the Forrester report focuses on cloud strategy, the most-recent DORA Accelerate State of DevOps Report (2023) provides additional context in some areas:

On AI adoption, DORA says, “More than half of respondents are already using AI for some technical tasks today, showing moderate improvements to employee well-being.” This suggests a higher current adoption rate than implied by the Forrester report, which describes GenAI as still in the early stages.

DORA also emphasises the importance of documentation, stating that “High-quality documentation leads to 25% higher team performance,” and also highlights cultural and work distribution aspects that aren’t addressed in the Forrester report, noting that teams with generative cultures perform 30% better and that job security can reduce burnout.

Finally, DORA emphasises the importance of focusing on the user, stating that this gives 40% better performance and 20% higher job satisfaction.

IBM’s article on Cloud Maturity Models (CMMs) provides additional context and frameworks for evaluating cloud adoption readiness. The article emphasises the importance of CMMs in addressing concerns around security, governance, and lack of resources and expertise. It suggests a three-phase assessment, cycling through Cloud Adoption Maturity, Cloud Security Maturity and Cloud-Native Maturity.

The IBM article emphasises that organisations may only need to reach the highest level of maturity in some models. However, it notes that some level of cloud maturity is likely necessary to remain competitive, given that 70% of workloads are expected to be on the cloud by 2024, according to Gartner.

The Cloud Native Computing Foundation (CNCF) also has a maturity model, outlining five levels of cloud-native adoption: Build, Operate, Scale, Improve and Optimise.

Each level represents increased cloud-native integration, from initial proof of concept to a fully optimised, flexible platform. The model emphasises the progression of organisational support, skill development, and the shift from centralisation to decentralisation as maturity increases.

The reports all highlight that more mature cloud postures drive more significant cloud ROI, and improve digital transformations. As organisations progress in their cloud journey, they can use these maturity models to assess their current state, identify areas for improvement, and develop strategies to maximise the benefits of cloud adoption while addressing key challenges such as security, cost optimisation, and skills development.

Google has announced a free trial program for AlloyDB, its fully managed PostgreSQL-compatible database service. The trial allows users to test AlloyDB’s capabilities with their own workloads for up to 30 days.

AlloyDB is designed to provide high performance, particularly in HTAP scenarios, with scalability, and reliability while maintaining full compatibility with open-source PostgreSQL. Google claims AlloyDB offers up to 4x faster transactional performance than standard PostgreSQL, potentially allowing users to run workloads on smaller instances and reduce costs.

Key features of AlloyDB include:

1. 99.99% availability SLA
2. Minimal downtime for planned operations
3. Columnar engine for analytics
4. AI-assisted capabilities for management and security
5. Vector search capabilities
6. Integration with Google’s Vertex AI and Gemini

The free trial provides users with a cluster containing an 8 vCPU, 64 GB RAM primary instance and 1 TB of regional storage. This offering is said to be more generous in terms of storage than some competitors’ trial programs. Users can access their trial clusters through various methods, including AlloyDB Studio in the console, PostgreSQL clients via public IP or Auth Proxy, or private IP for applications running in the user’s VPC.

Google positions AlloyDB as suitable for a range of users, including application developers, database administrators, businesses migrating from on-premises databases, startups, and data scientists working on AI applications.

While Google promotes AlloyDB as “the future of PostgreSQL,” it’s worth noting that other cloud providers offer similar managed PostgreSQL services. Amazon Web Services provides Amazon Aurora PostgreSQL-Compatible and Amazon RDS for PostgreSQL, while Microsoft Azure offers Azure Database for PostgreSQL. User muhaym on Reddit is complimentary towards AlloyDB:

It’s insanely good for analaytical workload, specially the ones with multiple joins – but it works like magic, I don’t know how, but it gets better automatically over time. On top of it, now I’m stuck, I need to move to AWS for different reason, and there’s no compatible alternative, I don’t think Aurora is as good as alloydb is today

Furthermore, a presentation from 2022 from Taras Kloba suggests AlloyDB outperforms AWS Aurora and Azure Cosmos DB at similar price points.

User recurrence however is slightly less positive:

They pitched it as a massive performance boost but I did not see that in most of my tests. The 2X better perf on average did not materialize however for large tables the vector columns did have a massive improvement. However, it didn’t create vector columns for many of the places that I would have liked unfortunately.

Interested users can start their AlloyDB trial by visiting the Google Cloud console or signing up through the AlloyDB free trial link. Google has also released an e-book with more information about AlloyDB for those seeking additional details.

As with any database migration or new technology adoption, users are advised to thoroughly test their specific workloads and compare performance and costs with their current solutions and other available options in the market.

HashiCorp has announced the general availability of Consul 1.19, introducing several improvements to its service networking platform. The latest version focuses on enhancing user experience, providing greater flexibility, and strengthening integration capabilities.

One of the key updates in Consul 1.19 is the introduction of a new “Registration” custom resource definition (CRD) for Kubernetes. This feature simplifies registering external services into the Consul service mesh. Previously, operators had to follow a three-step process involving Consul’s catalogue APIs, access control list (ACL) policy assignment, and termination gateway configuration. The new Registration CRD streamlines this workflow, offering a Kubernetes-native method for service registration and automatic updating of terminating gateway ACLs.

This new CRD compares favourably with similar functionality in products such as Istio, which has a “ServiceEntry” CRD, and Linkerd which has “ExternalWorkload” for access to external services.

Consul Enterprise users will also benefit from enhanced snapshot capabilities in version 1.19. The snapshot agent now supports saving Consul snapshots to multiple destinations simultaneously. This improvement allows organizations to implement robust backup strategies, potentially improving recovery time objectives. Supported storage options include local paths, NFS mounts, SAN attached storage, and cloud object storage services like Amazon S3, Google Cloud Storage, and Microsoft Azure Blob storage.

Consul 1.19 also significantly improves its integration with HashiCorp Nomad, the company’s cluster orchestrator. The update introduces support for Consul API gateway deployment on Nomad, enabling external clients to access services within the mesh. This feature facilitates load balancing, HTTP header modification, and traffic splitting based on weighted ratios.

Additionally, Consul’s transparent proxy feature is now available for Nomad environments. This simplifies service mesh adoption by automatically routing traffic to upstream services without requiring developers to modify their application configurations.

For enterprise users, Consul 1.19 extends admin partition support to Nomad. This feature enables multi-tenancy, allowing different teams to manage their application services autonomously while sharing the same Consul and Nomad control planes. Admin partitions aim to reduce management overhead and improve cost efficiency at scale.

HashiCorp has made documentation available for the new features, including guides on using the Registration CRD and deploying Consul API gateway on Nomad. The company encourages users to explore these new capabilities through their tutorials for both beginners and advanced users. Interested users can test commercial features like the snapshot agent and admin partitions through free trials of HCP Consul or self-managed Consul Enterprise.

The open-source Dagger project, which aims to be “CI/CD as code that runs anywhere,” recently released version 0.10. This release introduces custom Dagger Functions, a feature that simplifies CI scripts while expanding possibilities for developers seeking cleaner, more efficient pipelines. Also announced is the Daggerverse – a searchable index for public Dagger Functions.

Dagger Functions are the interface to the fundamental operations in Dagger, as each core operation is exposed via the API as a function. The recent release adds capabilities to allow developers to write their own functions, package them as reusable modules, and call them directly from the CLI. The new release adds the following new functionality:

Custom Function Authorship: This feature enables developers to create their own Dagger Functions, extending the API’s capabilities infinitely. Developers can write functions using the Dagger SDK, which allows them to code Dagger Functions in languages like Go, Python, and TypeScript. The Dagger Engine compiles developers’ functions into a specialized container at runtime, exposing a custom GraphQL API for invocation. This makes the functions immediately composable into dynamic pipelines, just like core Dagger functionality. Functions can call other functions, and they don’t all have to be written in the same language.

Reusable Modules: Dagger Functions are designed for safe reuse, fostering collaboration within the community. Developers can easily share and consume functions packaged into Dagger Modules. These modules are hosted as source code in a Git repository, ensuring decentralized distribution, version control, and dependency management, and without opinions about repository layout. When the modules are run, they are built locally. Semantic versioning is accommodated, and dependencies are pinned by default.

CLI Integration: Dagger Functions can be called directly from the command line interface using the Dagger CLI tool. This allows developers to run functions either from local storage or directly from a Git repository. The CLI introspects the module’s API, and exposes available functions and arguments, streamlining the invocation process.

Shortly after the release of Dagger Functions, Dagger also announced the Daggerverse – a searchable index of publically-available functions intended to allow developers to discover great modules provided by the community. This provides easy access to modules for common tasks such as linting, building, security scanning, secrets integration and deployment to popular cloud providers.

Dagger Functions are initially targeted towards CI optimization, but their versatility could extend beyond traditional CI workflows. Potential applications include test data management and SaaS integration. The Dagger team anticipates broader adoption across various development domains. Reaction from the community has been positive; writing on X (formerly Twitter), Tom Hacohen says:

“I first saw a demo of Dagger two years ago and you could sense something big was brewing. Now with Dagger functions […] it really feels like something we’ll all be using”.

The Dagger team suggests starting a migration by replacing cumbersome scripts and incrementally integrating Dagger Functions into projects. Quickstart Guides and Developer Module Guides cater to both newcomers and seasoned users, ensuring a smooth onboarding experience.

Infrastructure automation software company HashiCorp have announced a limited beta phase for HCP Vault Radar, a Software-as-a-Service (SaaS) based secrets discovery product. HCP Vault Radar is a secret scanning product that focuses on the proactive discovery of unmanaged or leaked secrets, allowing organizations to take swift action if secret information is exposed.

Following an alpha stage that began in October 2023, this beta release showcases new capabilities and integrations designed to bolster security for organizations managing sensitive information. The beta release adds role and attribute-based access controls (RBAC/ABAC). RBAC allows organizations to grant access by roles, while ABAC offers highly granular controls governing access based on user and object characteristics, action types, and more. These features enhance the ability to manage permissions, audit privileges, and comply with regulatory requirements efficiently.

HCP Vault Radar supports secret scanning from both a command line interface (CLI) and the HCP portal. The beta release expands on the data sources that can be used, now including Git-based version control systems, AWS Parameter Store, Confluence, Docker images, and Terraform Cloud and Terraform Enterprise. This addition enables users to scan a broader range of platforms than before.

Radar categorizes and ranks exposed data based on its level of risk, and as well as secrets also looks for PII (personally identifiable information) and non-inclusive language, scoring these risks appropriately. This allows DevOps and Security teams to prioritize remediation efforts effectively.

HCP Vault Radar also integrates with HashiCorp Vault, to allow Radar to scan supported data sources for leaked secrets actively in use within Vault. By cross-referencing with either Vault Enterprise or Vault Community, HCP Vault Radar provides an enhanced risk rating for discovered secrets. This prioritization ensures that organizations can address the most critical issues promptly.

HCP Vault Radar builds on HashiCorp Vault’s secrets lifecycle management functionality. Its automated scanning and ongoing detection capabilities empower organizations to be proactive  in identifying and remediating unmanaged secrets before they pose a security risk. The product is currently in a private beta program, and organizations interested in participating can sign up for updates to be considered for inclusion.

GitHub Copilot Chat, a natural language-powered coding tool, is now generally available, according to a recent announcement by GitHub. The tool, a part of GitHub Copilot, is designed to elevate natural language as a universal programming language.

GitHub Copilot Chat, powered by GPT-4, is a contextually-aware AI assistant tailored for development scenarios. It offers real-time guidance for developers without leaving their Integrated Development Environment (IDE), supporting them in tasks ranging from explaining complex coding concepts to detecting security vulnerabilities and writing unit tests.

The tool is generally available for both Visual Studio Code and Visual Studio, and is accessible to all GitHub Copilot individual users. Enterprise and organization administrators can grant access to Copilot Chat by enabling the setting for their users. It is also available at no cost to verified teachers, students, and maintainers of popular open-source projects. Developers can prompt Copilot Chat in their preferred natural language, including German, Portuguese and more. It is personalized to each developer, aligning with their unique coding practices, and is designed to help developers innovate quickly.

GitHub Copilot Chat supports seamless translation between programming languages, simplifying tasks such as code standardization, breaking up monoliths, and optimizing performance. Developers can use the tool to understand and translate code into the target language, reducing the need for rewriting and transferring logic. The tool adapts to each developer’s coding practices and provides real-time support for a wide array of coding tasks.

The announcement includes insights from GitHub developers on how they are leveraging Copilot Chat in their workflows. Examples cited were using Copilot Chat to translate a JavaScript application to Java and then to C#. The tool facilitated the process by generating high-quality results and aiding in the generation of unit tests. Another highlighted the use of Copilot Chat for quickly converting code between different languages, saving time on searching for specific command flags or syntax. And a third example emphasized the use of Copilot Chat to refresh coding practices, and allowing developers to concentrate on bigger thinking.

Geert Baeke, on X (formerly Twitter) also cites success in using Copilot Chat:

I wanted to plot a couple of embeddings on a 2D graph. In the past, I would have had to search how I have to do the dimensionality reduction, how matplotlib works, what other libraries to use, and the list goes on… Now it’s a few seconds in GitHub Copilot chat. It might not be optimal but it supports my data so it’s good enough.

GitHub is focused on bringing AI to the entire development lifecycle to assist developers in doing their best work whilst also enjoying the process. The guide for getting started with GitHub Copilot Chat is also provided for users interested in exploring its features.

The Open Source Security Foundation (OpenSSF) has recently announced SBOMit, a tool designed to bolster Software Bills of Materials (SBOMs) with in-toto attestations. This development, announced under the OpenSSF Security Tooling Working Group, increases transparency and security in the software development process.

Software Bills of Materials (SBOMs) serve as an inventory of components within a software package. There are various methods of storing SBOMs and an option for additional verification through signatures, but ensuring the integrity of the entire software development process remains a challenge as there is no guarantee that all the processes used to generate the software were properly executed to make the SBOM. SBOMit aims to provide a standardized, SBOM-format independent method for attesting components with added verification information.

In-toto, short for “integrity and transparency,” is a framework designed to provide a verifiable and reproducible mechanism for establishing the integrity of software supply chains. In-toto attestations are a crucial component of this framework. An in-toto attestation is essentially a record or statement that provides evidence of the steps taken to ensure the integrity of a software supply chain. These attestations serve as a way to verify that each step in the software development and deployment process has been carried out securely and without tampering.

SBOMit works by incorporating in-toto attestations into a software build. The resultant SBOMit document references the original SBOM document and includes cryptographically signed metadata about each step in the software’s development, along with a policy outlining the necessary procedures.

The inclusion of in-toto attestations helps mitigate the risk of accidental errors, and addresses issues such as humans overlooking essential steps in the development process. Moreover, it enhances security by making it harder for malicious activities to go undetected. SBOMit not only contributes to a more secure environment but also enables organizations to recover securely from compromises and promptly identify and prevent malicious activities.

Hosted under the OpenSSF Security Tooling Working Group, the SBOMit project is a collaborative effort within the industry to advance open-source security tools and best practices. The integration of in-toto attestations into SBOMs provides developers with increased assurance of the integrity and authenticity of their software components. The SBOMit specification is available on GitHub and contributions are welcomed.