sanjay.hona
Local time in Ottawa, Canada:--:--ET
← all tags

#github-actions

4 posts

  1. Pinning a GitHub Action to a tag object instead of its commit

    The first blog deploy failed on a SHA-pinned action. The pin was a tag object, and the release had no dist/. How to resolve a tag to its commit and check every pin.

    #github-actions#security#ci#git5 min read

  2. Security headers and HSTS preload as code, for a site on GitHub Pages

    GitHub Pages can't set response headers. How this site gets them from a Cloudflare rule and preload-ready HSTS, both kept in the repo and checked after every apply.

    #security#cloudflare#github-actions#hsts7 min read

  3. Publishing on a schedule with no backend

    How this blog queues posts ahead of time using only a frontmatter date and a daily GitHub Actions cron, with no database or CMS.

    #github-actions#astro#static-sites4 min read

  4. Hardening a static site: pinned actions, least privilege, and a CSP that can't drift

    A portfolio site has no backend, but its build pipeline and the edge in front of it still deserve a threat model. What I changed and why.

    #security#github-actions#csp#cloudflare4 min read