Sentry in Terraform, not the dashboard
Production alerting is infrastructure. In code it goes through review and keeps its history, and a Go contract test checks the rule before apply.
BC
2025 to present · personal
This portfolio
Developer portfolios assert competence. This one tries to prove it. Feature-based architecture with MVVM, unit, e2e and a11y tests running in CI, i18n, consent and Sentry. It ships through GitHub Actions with Terraform.
repository open source
The problem
An engineer portfolio usually lists technology. Listing proves nothing: the repository is public, so the way to prove it is to leave the process visible.
What I built
Next.js with a feature-based architecture and MVVM, i18n by route, consent before any event, and the observability infrastructure described in Terraform.
Technical decisions
Gitleaks over the full history
This is a public repo that deploys infrastructure. A secret leaked in an old commit is still leaked, so scanning the diff alone does nothing.
Actions pinned to SHAs
Tags are mutable, SHAs are not. Dependabot proposes the bump and I review it.
The Terraform plan never lands on a PR
The check status is public, the plan is not. A plan exposes production topology in an open pull request.
Serialized apply in a protected environment
It runs only on protected master, after every check, inside a GitHub production environment.
axe-playwright in CI
Accessibility that does not run in the pipeline rots on the first tight sprint.
Consent before any event
No analytics fires before the visitor chooses.
Result
ADR 0001 records the threat model of a public repository that deploys. The end-to-end suites cover accessibility and privacy, and CodeQL runs on pull requests, on master and once a week. The pipeline that ships this site is the same one you can read in the repository.