Security Gates in GitHub Actions
DevSecOps for Small Repositories and Side ProjectsBy Sloane Garrett
Length8h 3m
About this audiobook
What if the next npm install you run silently adds a backdoor to your side project — and you don't notice until your API keys are on the dark web?
Your GitHub repository has a secret problem. Not the kind you store in Settings > Secrets. The kind where your package-lock.json pins 47 vulnerable packages, your actions/checkout@v2 was deprecated six months ago, and that "helpful" contributor last week added a dependency with a post-install script that phones home.
You don't have a security team. You don't have a SOC 2 budget. What you have is this book — a field manual for solo developers who refuse to let their side projects become someone else's breach vector.
Inside, you'll build automated security gates that catch the mistakes you make at 11 PM: dependency audits that fail CI before vulnerable code merges, secret scanners that block API keys before they reach GitHub's servers, container image scanners that find CVEs in your Docker base layers, and incident response playbooks that fit on one page because you don't have time for forty.
Every chapter includes real, runnable YAML workflows and Python scripts — not theory. You'll harden pull requests, enforce third-party action policies, set up canary deployments with automatic rollback, and generate SBOMs that prove your supply chain transparency. You'll learn when to patch immediately, when to document and wait, and when a simple sha256sum beats enterprise attestation.
Stop pushing secrets at midnight — pre-commit hooks and CI scans that catch leaks before they fossilize in Git history
Turn your pull request into a security checkpoint — required status checks that block merges until vulnerabilities, secrets, and static analysis pass
Harden your .github/workflows folder — action pinning, SHA verification, and policies that prevent the next tj-actions supply chain attack
Deploy with a safety net — canary health checks, automatic rollback, and .env validation that stops production crashes
Build metrics that matter — weekly MTTP tracking, dependency freshness scores, and a 5-minute daily checklist that keeps your repo safer than most enterprise codebases
Your repository is already under attack — by automated scanners, by compromised dependencies, by your own 2 AM fatigue. Build the gates now. Before the alert that wakes you up.
Audiobook details
GenreTechnology
Length8 hrs 3 mins
Narrated byListen with 1,000+ voices
FormateBook with Audio
LanguageEnglish
Table of contents
1DevSecOps for Small Repositories and Side Projects
14Chapter 10: The Incident Response Playbook for One Person
2Sloane Garrett: TABLE OF CONTENTS
15PART III: THE REAL WORLD
3PART I: THE FOUNDATION
16Chapter 11: The Monorepo Problem
4Introduction: The $0 Security Budget
17Chapter 12: The Open Source Trap
5Chapter 1: The 3 AM Dependency Alert
18Chapter 13: The Legacy Repo Resurrection
Show all chaptersShow less
6Chapter 2: The .github/workflows Folder Nobody Understands
19Chapter 14: The Side Project That Became a Product
7Chapter 3: Secrets Leak in Plain Sight
20Chapter 15: The Compliance You Didn't Ask For
8Chapter 4: The Trust Problem with Third-Party Actions
21PART IV: THE ADVANCED GUARDRAILS
9PART II: THE GATES
22Chapter 16: The Supply Chain You Didn't Know You Had
10Chapter 5: The Pull Request as a Security Checkpoint
23Chapter 17: The Self-Hosted Runner Dilemma
11Chapter 6: Dependency Lockfiles Are a Lie
24Chapter 18: The Security Metrics That Matter
12Chapter 7: Container Images Nobody Audits
25Conclusion: The Gatekeeper's Mindset
13Chapter 8: The Code Review That Isn't
More from Sloane Garrett
Augmented Reality und Computer Vision Wie AR-Anwendungen die reale Welt verstehen, um virtuelle Objekte nahtlos zu integrierenSloane Garrett8h 50m$14 · $0.00
Automatisierte Textklassifizierung Wie man Dokumente, Tickets und Nachrichten mit überwachtem Lernen automatisch kategorisiertSloane Garrett7h 40m$10.20 · $0.00
Edge-AI-Engineering Wie man Künstliche Intelligenz am Netzwerkrand Aufbaut, Bereitstellt und OptimiertSloane Garrett6h 33m$13 · $0.00
Grundlagen der 3D-Computer Vision Tiefenschätzung, Punktwolkenverarbeitung und Volumetrische Rekonstruktion aus KameraanordnungenSloane Garrett7h 59m$13 · $0.00
Eingebettetes Machine Learning Vereinfacht Von Sensordaten zu Intelligenten Entscheidungen auf Ressourcenbeschränkter HardwareSloane Garrett8h 22m$13.50 · $0.00
Dialogsysteme und Chatbots Design konversationeller KI, die Kontext Versteht, Sich an Verlauf Erinnert und Natürlich AntwortetSloane Garrett8h 46m$16.50 · $0.00
LiftoffEric Berger9h 4m$29 · $0.00
ApolloCharles Murray, Catherine Bly Cox18h 15m$30
Improvised Weapons and Munitions - The Official U.S. Army ManualU.S. Department of the Army4h 38m$2 · $0.00
Frosty: The incredible true story of the boy from Doonside who became a Bathurst kingMark Winterbottom8h 9m$26 · $0.00
Cadillac Desert, Revised and Updated EditionMarc Reisner27h 56m$30
The Honey BusMeredith May9h 31m$25 · $0.00
Operation PedestalMax Hastings12h 29m$29 · $0.00
When the Heavens Went on SaleAshlee Vance18h 20m$40 · $0.00
Hands of TimeRebecca Struthers8h 8m5.0 (1)$26 · $0.00
Everybody Has a Podcast (Except You)Justin McElroy, Travis McElroy, Griffin McElroy5h 9m$24 · $0.00
The Collected WorksNikola Tesla50h 9m$1 · $0.00
Never Lost AgainBill Kilday10h 1m$29 · $0.00
How the Internet HappenedBrian McCullough13h 28m$23 · $0.00
Collected Writings of Nikola TeslaNikola Tesla, Thomas Commerford Martin21h 50m$1 · $0.00
Just AspireAjai Chowdhry9h 13m$29 · $0.00
The Little Book of AliensAdam Frank8h 20m$26 · $0.00
The inventions, researches and writings of Nikola Tesla (Annotated)Thomas Commerford Martin16h 59m$2 · $0.00
KargilV.P. Malik15h 18m$24 · $0.00
Fire on the HorizonTom Shroder, John Konrad8h 23m$26 · $0.00
The Smell of Kerosene (Annotated)National Aeronautics and Space Administration, Donald L. Mallick, Peter W. Merlin11h 32m$2 · $0.00