Digest #232: Why AWS Multi-Region Is Still Hard, The GitHub Actions Caches You're Missing, Claude Code on a Cloud VM and the Cloud Waste Your Bill Doesn't Show

Why multi-region AWS is still hard, the caches your GitHub Actions workflows are missing, PostgreSQL 19's plan advice, and a Kubernetes-native registry for your OpenTofu modules.

AWS had another rough year in us-east-1, and this week’s retrospective explains why multi-region still doesn’t come easy. Kubernetes v1.37 adds noexec mounts and emptyDir permissions. PostgreSQL 19 lets you pin a query plan the planner abandoned. Tigris got Git running on object storage. There’s a guide to the GitHub Actions caches most workflows skip, a scenario to test whether your AI SOC can trace a GitHub compromise into AWS, and a write-up on letting an agent rewrite a 92M message/day service.

If you’re interested in sponsoring this newsletter, feel free to reach out via LinkedIn or simply reply to this email.

A webhook platform for your AI agents

Most AI agents can’t receive a webhook: they run on a laptop, behind a VPN, or in a sandbox that blocks inbound traffic.

Svix Ingest takes events from Stripe, GitHub, incident.io, or anything else that sends webhooks, and your agent pulls them over an outbound HTTPS connection a few seconds later. No public URL, no tunnel, and nothing lost while it was offline - Try it out

My take: give your coding agent a failing test before asking for a fix

Newsworthy stories

• Finding the cloud waste your billing data misses

• How GLM built its own inference infrastructure

• Why AWS multi-region is still hard, even with AI

• A scenario to evaluate whether your agentic SOC can trace a GitHub workflow compromise into AWS

• Every database has these seven tables

Tutorials of the week

• A practical guide to GitHub Actions caching

• Kubernetes v1.37: hardening container storage

• You don’t need a Mac to develop iOS apps

• Running Claude Code and Codex on a cloud VM

• You can run Git on object storage if you remake packfiles

• Managing Kubernetes node drains with Pod Disruption Budgets

• PostgreSQL row-level security with EF Core and Npgsql

• I got tired of paying JFrog for a secure OpenTofu and Terraform registry, so I built my own

• Plan advice in PostgreSQL 19

• Monitoring the production agent lifecycle with AWS DevOps Agent

• A practical DuckDB and AI workflow for data analysis

Videos of the week

Projects of the week

• OpenDepot is a Kubernetes-native, self-hosted registry for OpenTofu and Terraform modules and providers.

• security-audit-skill turns your coding agent into a security auditor that hands every finding to a fresh agent to disprove before it reaches the report.

• RedAI sends validator agents into a running application to prove or disprove each vulnerability before reporting it.

• litecli is a command-line client for SQLite with autocompletion and syntax highlighting.

• Vex8s generates VEX documents by checking which container CVEs your Kubernetes security contexts already mitigate.

• Cline is a coding agent for your IDE, terminal, and desktop, with a headless mode for CI.

Meme of the week

OpenAI disclosed that, during training, some AI agents left instructions in their handoff notes telling the next agent to hide mistakes from the user.

Want to reach out to sponsor the newsletter? Book a slot - Q4 dates are open.