Sometimes you need to configure the workflow’s runner dynamically before it runs any steps. For example, you may need the runner to get access to a set of secure resources. This post shows how to use OpenID Connect (OIDC) tokens to avoid storing secrets or using long-lived credentials.

If you run your jobs in containers or use service containers, you may spend a lot of time waiting. If those images are outside of your runner environment, then you may also be seeing rising egress charges from your cloud provider. Let’s change that. Learn how pre-caching Docker images in custom runner images can significantly reduce workflow execution time by eliminating redundant layer downloads.

There’s a lot that custom runner images can do for your security. This post shows how pre-job scripts in custom runner images can enforce workflow validation that workflow authors can’t bypass – so only approved workflows run on your GitHub Actions runners.

GitHub finally let us build custom runner images, and today I’m going to be exploring what that means and how you can use it. I’ll show you how to bake your own images, add pre-job hooks that can setup and validate your environment before your workflow starts, and take advantage of caching to speed up your builds and reduce network egress.

Have you ever wished you could tighten your OIDC integration between Azure and GitHub? Ever wanted to restrict the connection to specific workflows instead of entire repositories? In this post, I’ll explore Azure’s flexible federated identity credentials and how you can use custom expressions to validate OIDC token claims.

In Part 1, I shared how disabling package scripts and using dev containers saved me from Shai-Hulud. But those were just the first two layers. Here’s where things get interesting – I’ll show you how signed commits can catch unauthorized changes before they happen, and how repository protections created a final safety net. These aren’t theoretical security measures. They’re the same practical defenses I use every single day.

When the Shai-Hulud v2 supply chain attack hit last week, I watched thousands of developers scramble to check their systems. Mine? I was able to mark it as safe. This was because I’d already layered in some straightforward security practices. If you’re wondering how to protect your own development environment from these kinds of attacks, I’ll walk you through the exact configurations and tools I use every day that kept me safe.

A creepy real-world branch name showed how a single Git ref can execute code in your Actions workflow and poison releases. See how the trick works, why it succeeded, and the quick fixes that turn a weaponized ref back into harmless text.

Many companies and teams focus on technical security solutions that lock down development and innovation to avoid risk. To protect their systems, they often end up making it harder for developers to do their jobs (and less secure in the process). What if I told you there was a better way? If you start with people and process first, you can create a secure CI/CD pipeline that balances safety and speed.

Securing DNS isn’t necessarily enough to protect your CI/CD environments. An application can connect directly to an IP or talk to an outside DNS service. In this post you’ll learn use iptables and ip6tables to restrict outbound DNS and block common DNS-over-HTTPS providers on GitHub-hosted runners.