What if you could run your own Docker registry, package cache, or proxy directly on your GitHub runners? Because custom images give you administrative rights, you can deploy persistent services that stick around for every workflow. In this post, you’ll discover how to turn your runners into powerful infrastructure hubs that speed up builds and cut your external dependencies dramatically.

Waiting minutes for a massive repository to clone in every workflow run is painful. I’ll show you how to bake that repository into your custom GitHub runner image and then use Git’s reference clone feature – a clever trick that cuts clone times from minutes to seconds.

When using GitHub custom images, you may need to handle sensitive information at different stages of the image lifecycle. Today, you’ll learn to use workflow commands to mask sensitive data during both image creation and job execution, ensuring secrets stay protected in your build logs.

Sometimes you need to configure the workflow’s runner dynamically before it runs any steps. For example, you may need the runner to get access to a set of secure resources. This post shows how to use OpenID Connect (OIDC) tokens to avoid storing secrets or using long-lived credentials.

If you run your jobs in containers or use service containers, you may spend a lot of time waiting. If those images are outside of your runner environment, then you may also be seeing rising egress charges from your cloud provider. Let’s change that. Learn how pre-caching Docker images in custom runner images can significantly reduce workflow execution time by eliminating redundant layer downloads.

There’s a lot that custom runner images can do for your security. This post shows how pre-job scripts in custom runner images can enforce workflow validation that workflow authors can’t bypass – so only approved workflows run on your GitHub Actions runners.

You’ve learned about individual secret management techniques, but the real power comes from combining them. In this final post of the series, I’ll show you how to layer multiple approaches to create defense-in-depth security that actually works in practice. Through real-world examples – from GitHub Actions to dev containers – you’ll see how to transform isolated techniques into comprehensive strategies that protect your secrets at every level.

GitHub finally let us build custom runner images, and today I’m going to be exploring what that means and how you can use it. I’ll show you how to bake your own images, add pre-job hooks that can setup and validate your environment before your workflow starts, and take advantage of caching to speed up your builds and reduce network egress.

Have you ever wished you could tighten your OIDC integration between Azure and GitHub? Ever wanted to restrict the connection to specific workflows instead of entire repositories? In this post, I’ll explore Azure’s flexible federated identity credentials and how you can use custom expressions to validate OIDC token claims.

A creepy real-world branch name showed how a single Git ref can execute code in your Actions workflow and poison releases. See how the trick works, why it succeeded, and the quick fixes that turn a weaponized ref back into harmless text.