Skip to content
hugo.pessoni

Contributions

What I did in other people's and teams' repositories: infrastructure, CI/CD, Kubernetes, web and security. Isolated commits that show what the AI cases don't.

Infrastructure as code

  • Merged PR

    Cloud Build connected to the GitHub organization

    Connected Cloud Build to GitHub at the organization level and unblocked an internal app deploy pipeline with least-privilege permissions.

    TerraformCloud BuildIAM
  • Merged PR

    Group permission, not a personal one

    Replaced a database permission granted to me with one granted to a publishers group, removing a single point of dependency.

    TerraformIAMFirestore
  • Merged PR

    IAM regression fixed

    A change made the deploy lose write access to Artifact Registry. I found the cause and restored it with the right scope.

    TerraformIAMArtifact Registry
  • Merged PR

    Support secrets in Secret Sync

    Moved the HMAC secrets and the support widget token into Secret Sync, in dev and staging, through Terraform.

    TerraformSecret ManagerKubernetes

CI/CD

  • Merged PR

    CI/CD migrated to Cloud Build

    Migrated deploy and tests of an internal app from GitHub Actions to Cloud Build with remote state, and updated spec and README to match reality.

    Cloud BuildTerraformGitHub Actions
  • Merged PR

    Build unblocked in the vulnerability scanner

    Forced a base image package upgrade so the build would pass Trivy.

    DockerTrivy

Kubernetes and operations

  • Merged PR

    Staging outage diagnosed

    With the site in private mode, the root returned 302, the GKE health check marked the pod unhealthy and the gateway served 503 everywhere. A HealthCheckPolicy on an always-200 endpoint fixed it.

    GKEGateway APIGhost
  • Commit

    Non-root sidecar

    Switched the sidecar image to nginx-unprivileged.

    Kubernetesnginx

Frontend and web product

  • Merged PR

    SEO package for the company website

    Product guide, thank-you page with a lead event, 404, expanded FAQ and JSON-LD, with Marketing and technical-review commits kept apart so either can be reverted alone.

    GhostHandlebarsJSON-LD
  • Merged PR

    Company website theme

    New navbar and footer, home aligned with the approved design, lead-capture modal and transactional email.

    GhostHandlebarsSendGrid
  • Merged PR

    Academic platform in Spring Boot

    Implemented projects, scientific papers, technologies and idea collaboration in a classmates’ platform.

    JavaSpring Boot

Applied security

  • Merged PR

    Security for an AI-generated HR app

    Merged an AI-generated version with a secure one: Argon2id, AES-256-GCM for personal data, rate limiting, four-role RBAC, bootstrap-only admin and no made-up KPIs on the dashboard.

    FastAPIFirestoreArgon2idAES-256-GCM
  • Merged PR

    Support widget with verified identity

    CSP frame-src, iframe handshake with an explicit targetOrigin and backend-computed HMAC.

    CSPHMAC-SHA256postMessage

Open source

  • Open PR

    Chatwoot widget fix

    set_custom_attributes now merges conversation attributes instead of overwriting them.

    Ruby on Rails

Community

  • Role

    Company AI committee

    I am part of the team that executes what the AI committee defines: I build, test and document.

    IA aplicada
  • Role

    Gemini Student Ambassador

    I represent UTFPR-CP in Google’s student ambassador program.

    Gemini