Eliminating Long-Lived Cloud Secrets via GitHub Actions OIDC Federation
Stop storing long-lived cloud keys in GitHub Secrets. Learn how to use OIDC federation to exchange short-lived GitHub tokens for temporary cloud credentials.
Loading…
ReadMeFeed / Community knowledge
#github-actions
Real questions. Useful conversations. Find the people who know your stack.
githubReducing CI/CD Duplication with GitHub Actions Composite Actions
Learn how to create and use GitHub Actions composite actions to eliminate duplicated CI steps, improve maintainability, and version shared workflow logic across repositories.
Drop Long-Lived PyPI Tokens: A Practical Guide to Trusted Publishing
Long-lived PyPI API tokens in CI are a standing risk. Trusted Publishing uses OpenID Connect to issue short-lived, workflow-scoped credentials automatically—here is how to wire it up and what to watch for.
pypiManaging Multi-Environment Testing with GitHub Actions Matrix Strategies
Learn how to use GitHub Actions matrix strategies to run tests across multiple OS and language versions without duplicating YAML code.
githubactionsEnforcing Code Quality in CI/CD with SonarQube Quality Gates
Use SonarQube Quality Gates to enforce code quality thresholds in CI/CD. Learn how to set up gates, integrate them into GitHub Actions, understand trade‑offs, and verify results locally.
Choosing Between GitHub‑Hosted and Self‑Hosted Runners: A Practical Decision Guide
Decide whether to use GitHub‑hosted or self‑hosted runners for your CI pipeline by evaluating budget, security, performance, and maintenance. Includes a comparison table, trade‑offs, and a concrete workflow example with validation steps.
Choosing Between Combined and Flagged Codecov Uploads for Test Suite Coverage
Decide whether to use a single combined Codecov upload or per‑suite flagged uploads. See a compact options table, trade‑offs, a GitHub Actions example with flags, and validation steps.
codecovCentralizing CI with GitHub Actions Reusable Workflows: Inputs, Secrets, and Versioning
Learn how to share CI logic across repos with GitHub Actions reusable workflows, manage inputs, outputs, secrets, and permissions, and avoid the pitfalls of coupling and unpinned changes.
Integrating Qodana into GitHub Actions: From Static Analysis to Pull‑Request Checks
Integrate Qodana into GitHub Actions so static‑analysis results appear as a GitHub check on every PR. Learn how to configure it, manage licensing, and balance performance trade‑offs with a concrete workflow example.
qodana