Detecting Terraform Vulnerabilities with Checkov: An Insecure vs Secure Comparison Demo

IaC security should be verified before you apply. Checkov lets you detect Terraform vulnerabilities through static analysis. Using five AWS resources (S3, Security Group, RDS, IAM, CloudTrail), this demo reproduces the journey from 37 FAILEDs to 111 PASSEDs in a public repository.

Setting Up CD and Preview Environments with Firebase Hosting + GitHub Actions

Reference notes on setting up CD and preview environments with Firebase Hosting's Preview channels and GitHub Actions.

Cutting CI Costs in AI-Driven Solo Development with gh-signoff — Local CI and the Signoff Model

Hand implementation to a coding agent and your push count explodes, quietly inflating the remote CI bill. gh-signoff offers a blunt but sensible answer: run the tests on your own machine and sign off on them yourself.

Automating git commit and branch creation with GitHub Actions

A GitHub Actions workflow sample that automates branch creation, commit, and push.

Using IAM Roles in GitHub Actions Without Passing AWS Credentials Directly

A reference article on assuming AWS IAM Roles from GitHub Actions without long-lived credentials.

How to Handle Multi-line Strings and Newlines in GitHub Actions

A short note on using EOF-style delimiters to set multi-line strings and newlines in GitHub Actions.

Prevent Waste by Specifying timeout-minutes in GitHub Actions

Set timeout-minutes on GitHub Actions jobs and steps to avoid the 6-hour runner cap and wasted quota.

Debugging GitHub Actions for GitHub Pages Deployment by Deploying on Every Push

Set the GitHub Actions workflow to on: push: only, so every push deploys to GitHub Pages for quick debugging.

Deploying Next.js (SSG) to GitHub Pages Using Custom GitHub Actions Workflows

Deploying Next.js (SSG) to GitHub Pages via a Custom GitHub Actions workflow, no build artifact commits required.

Hardening npm Publishing with Trusted Publishing — Tokenless OIDC, Staged Publishing, and PR-Merge Releases

After the 2025-2026 npm supply-chain attacks, publishing with a long-lived token is no longer the default. Authenticate with GitHub Actions OIDC Trusted Publishing so there is no publish secret, make CI capable of only staging a package, and keep live promotion as a separate npm MFA step. Restrict the release Environment to the PR merge ref, and automate even the release PR itself. The result is a multi-boundary defense where repository write access alone cannot produce a live npm package.

Keyless-Signing CLI Artifacts with Sigstore cosign — GitHub Actions OIDC, Bundle Verification, and a Tamper Test

The weakness of out-of-band distribution is that nobody can confirm the artifact they received actually came from that org's workflow and was not modified along the way. Sigstore cosign keyless signing lets you sign artifacts with a GitHub Actions OIDC identity, holding no long-lived signing key. Fulcio issues a short-lived certificate and the signing event lands in a transparency log. By pinning the certificate identity and OIDC issuer, verifiers can confirm that this repository's workflow signed it. We assemble a recipe end to end that signs both the npm .tgz and the Google Drive zip, with a tamper test wired into CI so verification provably fails on modified bytes.

Detecting Terraform Misconfigurations with Trivy: A Comparison Demo with Checkov

Following our Checkov demo, we scanned the same Terraform code with Trivy. Checkov found 37 issues; Trivy found 27. Where does the gap come from? We compare severity classification, IAM wildcard handling, and check ID systems using actual scan results.