DevOps

We all know that we should pin GitHub Actions that come from external repositories. If a repository is compromised, pinning to a specific commit SHA can prevent malicious code from accessing your secrets during a workflow run. We also know that we rarely do this. My reasons were: It adds extra work SHAs are hard to read and verify I assumed Dependabot did not work with SHA-pinned actions After reading this tweet (recommended reading), I learned that you can actually combine SHA pinning with Dependabot updates. The trick is to include the human‑readable version as a comment after the SHA. ...

There are many ways to host web applications. You can run them in the cloud or on-premises, using everything from “copy some PHP files into a folder” to full container orchestration on Kubernetes — and everything in between. My Requirements I optimize for deployments with: Zero downtime — users shouldn’t get kicked out during updates. This means the application must be stateless, with all state stored externally. (Also useful when I inevitably get millions of users 😊) Proper HTTPS Low operating cost Fast and easy to update Your requirements may be different, but mine are tuned for a homelab software developer who deploys often to a professional‑looking “test environment.” Updates should be simple, quick, and not disrupt anyone using the app. ...

I’ve built a web application—and that needs a home. What should I deploy it to? There are many platforms to choose from, I decided to turn the deployment decision into a mini project with three phases: Design the ideal platform and deployment process Implement the design Learn from the experience I’m usually skeptical of too much upfront planning—real-world constraints tend to surprise you—but I’m giving it a shot. 🧾 Requirements Here’s what I need from the platform: ...