Thoughts on engineering, products, and building software.https://abigroup.io/https://abigroup.io/en/blog/argocd-github-actions-oidchttps://abigroup.io/en/blog/argocd-github-actions-oidcHow to let GitHub Actions diff and sync ArgoCD applications without a static ArgoCD API token in CI secrets, using ArgoCD's own built-in Dex for a token exchange and RBAC scoped to the GitHub OIDC claims.Sat, 08 Aug 2026 00:00:00 GMTAndré LorethEngineeringhttps://abigroup.io/en/blog/gh-token-brokerhttps://abigroup.io/en/blog/gh-token-brokerWhy we built a broker that exchanges a GitHub Actions OIDC identity token for a short-lived, least-privilege GitHub App installation token, gated by CEL policy.Mon, 20 Jul 2026 00:00:00 GMTAndré LorethEngineeringhttps://abigroup.io/en/blog/self-hosted-tunnels-frp-celhttps://abigroup.io/en/blog/self-hosted-tunnels-frp-celngrok gates team SSO behind paid tiers and Cloudflare Tunnel locks you into its Zero-Trust model. We self-host frp instead, and wrote a CEL-based server plugin so our own IdP decides who can proxy what.Sun, 19 Jul 2026 00:00:00 GMTAndré LorethEngineeringhttps://abigroup.io/en/blog/oidc-token-clihttps://abigroup.io/en/blog/oidc-token-cliWhy we built a small Go CLI that fetches and caches OpenID Connect tokens, so kubectl, frpc, curl, and CI never have to implement auth themselves.Sat, 18 Jul 2026 00:00:00 GMTAndré LorethEngineeringhttps://abigroup.io/en/blog/why-we-built-abi-grouphttps://abigroup.io/en/blog/why-we-built-abi-groupA first note from the founders: what abi group is, why we started it, and what we hold to.Fri, 01 May 2026 00:00:00 GMTAndré LorethNews