The riskiest line in your repo isn’t in "src/", it’s in ".github/workflows/"
Self-hosted runners feel more secure at first since they execute jobs directly on machines you manage. But they introduce new attack surfaces, and managing them securely and reliably is hard.
At Ubicloud, we built managed GitHub Actions runners with security as the top priority. We provision clean, ephemeral VMs for each job, and they're fully isolated using Linux KVM. All communication and disks are encrypted.
They’re fully compatible with default GitHub runners and require just a one-line change to adopt. Bonus: they’re 10× more cost-effective.
When you search for "dotfiles" on GitHub, you'll find plenty of good script examples for setting up a new computer. Since Apple doesn't provide good documentation on what you can configure with "defaults" variables, these examples are a goldmine.
Not sure about introducing yet another string prefix. Between f-strings, raw strings, and i18n stuff, it’s already getting crowded. Curious how readable this will be in large codebases.