Tag: ci-cd

Docker layer cache works on your laptop but CI starts cold. Fix it with registry cache or type=gha, set scope and mode=max, and debug why hits still miss.

A secret that reaches git push is already gone. Compare gitleaks, TruffleHog, and detect-secrets as pre-commit hooks, with working configs you can copy.

Self-hosted GitHub Actions, Forgejo, and GitLab runners can hand a forked pull request root on your box. Here is the isolation ladder that actually stops it.

Daemonless OCI image builds in CI without Docker-in-Docker risks. Kaniko vs Buildah compared, when each fits, and which one suits your pipeline.

regctl, regbot, and regsync give you tag retention policies, registry replication, and manifest surgery, no Docker daemon required.

ArgoCD ApplicationSets let one template generate dozens of GitOps Applications across clusters. Covers List, Cluster, Git, Matrix, and PR generators with real patterns.

Build Docker images that run on amd64 and arm64 from one command. QEMU emulation, native multi-node builders, CI caching, and manifest lists explained.

OPA and Rego aren't just Kubernetes gatekeepers. Block :latest tags in CI, enforce Terraform resource tags, and filter HTTP APIs.

Run GitHub Actions-style CI on your own Forgejo server with Forgejo Runner. Same YAML, your hardware, zero GitHub dependency.

Skopeo lets you copy, inspect, and sync container images between any registry without Docker. No daemon, no bloat, just clean image ops.

Two years after HashiCorp's BUSL switch and IBM's acquisition, OpenTofu is the mature open-source Terraform fork. Here's the honest state of play.

Keyless signed git commits with Sigstore and Gitsign, no GPG key rot, no passphrase prompts. OIDC-backed ephemeral certs that just work.