Ken Muse

Your dotfiles repository already personalizes your development environments, but what if it could do more? What if the same configurations that protect your local machine could secure your CI/CD pipelines? By adding a simple composite action to your dotfiles repo, you can apply security settings and configurations to any GitHub runner – without managing tokens or cloning anything yourself. Let me show you how.

Have you ever needed to attach a build number, test result, or code review comment to a commit after it’s already been pushed? Modifying the commit history isn’t an option—especially if you sign your commits—but Git has a feature designed exactly for this. In this post, I’ll show you how to use Git notes to annotate your commits with extra metadata without breaking your history or invalidating your signatures.

If you’ve ever migrated a repository from Perforce to Git and wondered where all your beautiful branch and integration history went, you’re not alone. I’ve helped teams through this transition, and the migration process always creates this confusion. The issue isn’t a bug in the migration tool. It’s a fundamental difference in how these systems think about branches and history. Let me walk you through why this happens, what it means for your migrations, and why training your team is just as important as the technical migration itself.

Ever wonder what actually happens when you run git merge? Spoiler – it’s not magic, just some clever graph walking.

As 2025 comes to a close, I’m reflecting on a year of unexpected opportunities, new learnings, and a bit of personal growth. Writing, traveling, and speaking … this year has been a journey of growth and connection. Today I celebrate the many small wins and look forward to what 2026 has in store.

Ever wonder what’s really happening inside that .git folder? Discover how Git’s elegant content-addressable filesystem turns commits, branches, and merges into a simple graph of objects.

What if you could run your own Docker registry, package cache, or proxy directly on your GitHub runners? Because custom images give you administrative rights, you can deploy persistent services that stick around for every workflow. In this post, you’ll discover how to turn your runners into powerful infrastructure hubs that speed up builds and cut your external dependencies dramatically.

Waiting minutes for a massive repository to clone in every workflow run is painful. I’ll show you how to bake that repository into your custom GitHub runner image and then use Git’s reference clone feature – a clever trick that cuts clone times from minutes to seconds.

When using GitHub custom images, you may need to handle sensitive information at different stages of the image lifecycle. Today, you’ll learn to use workflow commands to mask sensitive data during both image creation and job execution, ensuring secrets stay protected in your build logs.

Sometimes you need to configure the workflow’s runner dynamically before it runs any steps. For example, you may need the runner to get access to a set of secure resources. This post shows how to use OpenID Connect (OIDC) tokens to avoid storing secrets or using long-lived credentials.