DevOps

We all know that we should pin GitHub Actions that come from external repositories. If a repository is compromised, pinning to a specific commit SHA can prevent malicious code from accessing your secrets during a workflow run. We also know that we rarely do this. My reasons were: It adds extra work SHAs is hard to read and verify I assumed Dependabot did not work with SHA-pinned actions After reading this tweet (recommended reading), I learned that you can actually combine SHA pinning with Dependabot updates. The trick is to include the human‑readable version as a comment after the SHA. ...

There are many ways to host web applications. You can run them it in the cluod or on-premises, using everything from “copy some PHP files into a folder” to full container orchestration on Kubernetes — and everything in between. My Requirements I optimize for deployments with: Zero downtime — users shouldn’t get kicked out during updates. This means the application must be stateless, with all state stored externally. (Also useful when I inevitably get millions of users 😊) Proper HTTPS Low operating cost Fast and easy to updates Your requirements may be different, but mine are tuned for a homelab software developer who deploys often to a professional‑looking “test environment.” Updates should be simple, quick, and not disrupt anyone using the app. ...

Exploring deployment options for a web app with a focus on cost, speed, and learning.