A creepy real-world branch name showed how a single Git ref can execute code in your Actions workflow and poison releases. See how the trick works, why it succeeded, and the quick fixes that turn a weaponized ref back into harmless text.

Many companies and teams focus on technical security solutions that lock down development and innovation to avoid risk. To protect their systems, they often end up making it harder for developers to do their jobs (and less secure in the process). What if I told you there was a better way? If you start with people and process first, you can create a secure CI/CD pipeline that balances safety and speed.

Securing DNS isn’t necessarily enough to protect your CI/CD environments. An application can connect directly to an IP or talk to an outside DNS service. In this post you’ll learn use iptables and ip6tables to restrict outbound DNS and block common DNS-over-HTTPS providers on GitHub-hosted runners.

Lately I’ve seen people spin up self-hosted runners just to lock down network egress. That creates maintenance overhead – and your time is valuable. You may not realize this, but you can restrict outbound domains while still using GitHub-hosted runners. In this post you’ll learn how to use a local Unbound allowlist so only approved domains resolve.

Managing a cluster of machines that each need to clone a large repository? Wondering how you can make it faster to clone a Git repo on the other side of the world? In this post, you’ll learn how Git’s reference option can dramatically reduce clone times and bandwidth usage. You’ll also learn how Git handles missing objects when your reference is out of date.