Blog
Thoughts on engineering, products, and building software.
Killing the ArgoCD token: trading GitHub Actions OIDC for scoped sync access
How to let GitHub Actions diff and sync ArgoCD applications without a static ArgoCD API token in CI secrets, using ArgoCD's own built-in Dex for a token exchange and RBAC scoped to the GitHub OIDC claims.
Killing GitHub PATs: trading OIDC tokens for scoped GitHub App credentials
Why we built a broker that exchanges a GitHub Actions OIDC identity token for a short-lived, least-privilege GitHub App installation token, gated by CEL policy.
Self-hosted tunnels with real SSO: frp plus a CEL policy engine
ngrok gates team SSO behind paid tiers and Cloudflare Tunnel locks you into its Zero-Trust model. We self-host frp instead, and wrote a CEL-based server plugin so our own IdP decides who can proxy what.
oidc-token-cli: one OIDC client for every tool
Why we built a small Go CLI that fetches and caches OpenID Connect tokens, so kubectl, frpc, curl, and CI never have to implement auth themselves.
Why we built abi group
A first note from the founders: what abi group is, why we started it, and what we hold to.