October 26, 2026
Give alert triage its own token permissions
A dedicated GitHub Actions workflow can read Dependabot alerts without inheriting the broader permissions used to build, publish, or deploy software.
Read article
Posts tagged “ci-cd”.
One tag at a time. The full list is on the articles page.
October 26, 2026
Treat workflow changes as governed releases
I explain how to inventory workflow changes across repositories, require trusted review, and keep credentials out of untrusted workflow runs.
Read article
October 26, 2026
Pin C# language behavior separately from the .NET SDK
I explain why SDK selection and C# language policy belong in separate settings, and how to roll out language changes across a repository fleet.
Read article
October 19, 2026
A runner-image SBOM is not build provenance
A runner-image SBOM inventories preinstalled software, while build provenance connects an artifact to the workflow, actions, and inputs that produced it.
Read article
October 19, 2026
Treat repository-relative workflow references as a versioning choice
A repository-relative GitHub Actions reference ties a reusable workflow to the caller's version, trading centralized upgrades for co-versioned changes.
Read article
October 13, 2026
Treat GitHub Actions cache reuse as a trust boundary
A cache can expose data to readers or let an untrusted workflow influence a trusted build, so I make cache access part of pipeline security design.
Read article
October 13, 2026
CI egress policy should follow workflow trust
Runner identity is not enough to decide what a CI job may contact; I explain how to map dependencies and separate policy by job purpose.
Read article
October 13, 2026
Deeper workflow nesting needs a legible call graph
Deeper reusable workflows make shared CI/CD more flexible, but clear ownership, inputs, permissions, and deployment paths are what keep changes reviewable.
Read article
October 13, 2026
Treat Helm 4 adoption as a deployment-toolchain migration
A Helm major-version upgrade can leave charts unchanged while changing assumptions in clients, plugins, pipelines, and cluster interactions.
Read article
October 13, 2026
Execution policy belongs outside the workflow
GitHub Actions execution protections can block disallowed runs before workflow code starts, but they cannot make trusted workflow code safe.
Read article
October 13, 2026
A workflow security incident needs a recovery design
A recovery-ready CI architecture maps compromised actions to repositories and credentials, then restores safe shipping without reopening the same blast radius.
Read article
October 13, 2026
Trial .NET 11 without changing the production build
A reusable pipeline can test services with the .NET 11 preview SDK and runtime while keeping its established production toolchain unchanged.
Read article
October 8, 2026
Treat custom runner images as build dependencies
I argue for versioning custom GitHub Actions runner images as shared build dependencies, with clear ownership for patching, validation and rollout.
Read article
October 6, 2026
A GitHub Actions lockfile needs an update policy
A lockfile can make workflow dependencies easier to audit, but shared pipelines still need owners, cross-repository tests, and an urgent-fix path.
Read article
October 2, 2026
Make secret access explicit in reusable workflows
Learn how scoped secrets could change reusable workflow contracts, and how to roll out explicit access and verify it with execution telemetry.
Read article