uses: some/action@v2 resolves a tag, and a tag is a mutable pointer — so the code running in your pipeline can change without anything in your repository changing.…
Passing a private repository token as a build argument writes it into the image history, where docker history reads it back out for anyone who can pull the…
A secret in an environment variable is visible in docker inspect, in the process environment and in any crash dump that prints the environment. The _FILE convention is…
A workflow triggered by pull_request from a fork has no secrets, deliberately. pull_request_target runs in the context of the base repository and does have them. Combining pull_request_target with…
A limit with no feedback means a well-behaved client cannot behave well — it finds out by being refused, and its only strategy is to retry. Retry-After is…
Buster defaults to the nftables backend with an iptables compatibility shim, so iptables -L and nft list ruleset can show different things and both are telling the truth.…
Managing authorized_keys across thirty servers means a configuration run to add a colleague and another to remove one, and the removal is the one that gets forgotten. Access…
Behind a proxy, $remote_addr is the proxy. Reading X-Forwarded-For instead is correct only if you also refuse to believe it from anyone but the proxy. This matters for…