SQL for the software development lifecycle
Joined June 2021
- Tweets95
- Following6
- Followers90
- Likes120
MergeStat retweeted
If you haven't bumped into @mergestat, it's very interesting! It enables you to write SQL queries over your git history to find out lots of useful things, such as:
- Versions of langs/libs
- Which repos had commits
- Which repos use Jenkins for CI/CD
mergestat.com/
MergeStat retweeted
Grafana community spotlight 💫 @patrickdevivo of @mergestat explains how to monitor CVE security vulnerabilities with Grafana, MergeStat, and OSV-Scanner. Today on the blog: grafana.com/blog/2023/05/25/…
MergeStat retweeted
Today we're live on the @grafana blog! Learn how to manage CVE security vulnerabilities with Grafana, @mergestat, and @Google's OSV-Scanner
grafana.com/blog/2023/05/25/…
MergeStat retweeted
Peter Freiberg wrote a great post, "Finding A Pin in a Docker Stack 🪡" (get it? 🙂), showing how @mergestat can identify common issues in Dockerfiles across an org
"finding stale Dockerfiles" is a *type* of question our new UI experience (coming soon) can answer quickly!
Terraform Meets SQL to Secure Cloud Infrastructure ☁️
Use @tfsec_dev + @grafana + @mergestat to understand, explore and report on misconfigurations across @HashiCorp terraform repos!
docs.mergestat.com/blog/2023…
MergeStat retweeted
we're putting together a @mergestat demo site that indexes the top 500 public GitHub repos by star count for ~20 languages. Playing with some questions - like how many of those repos use @nextjs? (or rather...how many have a file that looks like a nextjs config)
MergeStat retweeted
was very cool to hear of a @mergestat user joining CODEOWNERS content from their repos with vulnerability data from @AquaSecTeam's trivy, to get a report of CRITICALs CVEs *by team* across an org 😎
MergeStat retweeted
pinning to specific @Docker images is important for deterministic builds, but can be overlooked when maintaining dependency and security updates - @mergestat can be used to query Dockerfiles across an organization to better understand pinning practices 📍
docs.mergestat.com/blog/2023…
MergeStat retweeted
Today we're thrilled to announce @mergestat v2, a significant improvement to how we extract and sync data from git repos -> SQL!
tl;dr we're running @Podman_io containers defined externally to run an analysis on a repo and store the results in postgres
docs.mergestat.com/blog/2023…
MergeStat retweeted
I've been using @deno_land again to implement data syncs, in a new approach we've been working on @mergestat - and it's been really slick!
top-level await is 👌
MergeStat retweeted
We spent some time playing with git blame data, and came up with some interesting queries!
We also learned a bit about the @MongoDB source code running these queries
docs.mergestat.com/blog/2023…
MergeStat retweeted
until today, @mergestat has pretty much only supported repos on @github (and local repos on disk). Today we're very excited to add support for @Bitbucket and @gitlab as well🎉
docs.mergestat.com/blog/2023…
MergeStat retweeted
Are We Vulnerable? (e.g. Log4Shell) - Identifying Open-Source Library Risk Using @mergestat (Part 2) 🎉
docs.mergestat.com/blog/2023…
MergeStat retweeted
Recently, someone asked how they could use @mergestat to query the contents of their YAML files (across many git repos) to validate configs.
We put together an interesting (weird? 😃) solution, using PostgreSQL, plv8, JavaScript, and MergeStat.
docs.mergestat.com/blog/2023…
Working on @mergestat, we often want to know about how frequently we ship new versions 🚀 (in particular, if we're due for a new release). We've been using @grafana to track this visually:
docs.mergestat.com/blog/2023…
MergeStat retweeted
@jaosorior told us about @renovatebot some time ago, and we ended up introducing it into @mergestat repos! Interestingly - querying for the presence of it has been a use case that's popped up several times now (across hundreds or thousands of codebases)
docs.mergestat.com/blog/2023…
MergeStat retweeted
put together some example SQL for managing open-source vulnerabilities (CVEs) in @mergestat using @GrypeProject and trivy (@AquaSecTeam).
for us, it's been valuable to see this data *across* our codebases and in some cases join it with git activity
docs.mergestat.com/blog/2023…
We're excited to announce that the most recent releases of MergeStat now include basic data visualization capabilities!
docs.mergestat.com/blog/2023…
MergeStat retweeted
Spent some time today putting together a CLI that uses @OpenAI codex models for natural language -> SQL: github.com/mergestat/scribe
(taking what we learned doing it in @mergestat-lite), but generalizing for any SQL database
