Ken Muse

Ever wonder what’s really happening inside that .git folder? Discover how Git’s elegant content-addressable filesystem turns commits, branches, and merges into a simple graph of objects.

What if you could run your own Docker registry, package cache, or proxy directly on your GitHub runners? Because custom images give you administrative rights, you can deploy persistent services that stick around for every workflow. In this post, you’ll discover how to turn your runners into powerful infrastructure hubs that speed up builds and cut your external dependencies dramatically.

Waiting minutes for a massive repository to clone in every workflow run is painful. I’ll show you how to bake that repository into your custom GitHub runner image and then use Git’s reference clone feature – a clever trick that cuts clone times from minutes to seconds.

When using GitHub custom images, you may need to handle sensitive information at different stages of the image lifecycle. Today, you’ll learn to use workflow commands to mask sensitive data during both image creation and job execution, ensuring secrets stay protected in your build logs.

Sometimes you need to configure the workflow’s runner dynamically before it runs any steps. For example, you may need the runner to get access to a set of secure resources. This post shows how to use OpenID Connect (OIDC) tokens to avoid storing secrets or using long-lived credentials.

If you run your jobs in containers or use service containers, you may spend a lot of time waiting. If those images are outside of your runner environment, then you may also be seeing rising egress charges from your cloud provider. Let’s change that. Learn how pre-caching Docker images in custom runner images can significantly reduce workflow execution time by eliminating redundant layer downloads.

There’s a lot that custom runner images can do for your security. This post shows how pre-job scripts in custom runner images can enforce workflow validation that workflow authors can’t bypass – so only approved workflows run on your GitHub Actions runners.

You’ve learned about individual secret management techniques, but the real power comes from combining them. In this final post of the series, I’ll show you how to layer multiple approaches to create defense-in-depth security that actually works in practice. Through real-world examples – from GitHub Actions to dev containers – you’ll see how to transform isolated techniques into comprehensive strategies that protect your secrets at every level.

What if you could eliminate static secrets entirely? That’s the promise of modern cloud-native approaches, but they come with their own tradeoffs. In this second post of the series, I’ll take you beyond traditional storage methods to explore federated identities, managed identities, and secret vaults. You’ll learn when each approach makes sense and how to protect yourself from the new attack vectors they introduce.

Every application needs secrets, but keeping them secure while making them available when needed is tricky! In this first post of the series, I’ll walk you through common storage approaches – from simple files to hardware security modules – exploring their strengths, weaknesses, and how to make each one more secure.