#github-actions

[ follow ]
DevOps
fromtheregister
1 day ago

GitHub Actions outage told devs 'your account is suspended'

GitHub Actions outage for hours disrupted CI/CD workflows, with incorrect suspension errors and authentication-related degraded performance affecting most runs.
fromInfoQ
1 day ago

Pullfrog AI: Open-Source CodeRabbit Alternative Powered by GitHub Actions

Pullfrog, an open-source AI-powered GitHub bot created by Colin McDonnell, is in beta, positioning itself as a model-agnostic alternative to CodeRabbit that runs entirely within GitHub Actions. McDonnell announced Pullfrog on May 12, 2026. The tool is designed as an orchestration layer for asynchronous development inside GitHub, listening for webhooks and triggering AI agent runs based on configurable events such as new pull requests, issues, CI failures, and review submissions.
Software development
Information security
fromSecurityWeek
3 days ago

Over 5,500 GitHub Repositories Infected in 'Megalodon' Supply Chain Attack

Megalodon used GitHub Actions workflow injection via automated commits to steal CI and cloud secrets from thousands of repositories.
Information security
fromThe Hacker News
6 days ago

Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD Workflows

Megalodon used forged CI workflow commits to exfiltrate CI secrets, cloud credentials, tokens, keys, and configuration data from thousands of GitHub repositories within hours.
#devsecops
DevOps
fromDevOps.com
6 days ago

Designing an AI-Powered DevSecOps Guardrail Pipeline Using GitHub Actions - DevOps.com

Embedding AI-powered security scans into GitHub Actions guardrail pipelines blocks insecure code before builds and deployments proceed.
fromMedium
8 months ago
Information security

From Jenkins to GitHub Actions: Evolving a Secure DevSecOps Pipeline with Canary Deployments

Migrate CI from Jenkins to GitHub Actions; strengthen secrets and security; adopt canary progressive delivery; use Ingress to expose applications for scalable DevSecOps pipelines.
DevOps
fromDevOps.com
6 days ago

Designing an AI-Powered DevSecOps Guardrail Pipeline Using GitHub Actions - DevOps.com

Embedding AI-powered security scans into GitHub Actions guardrail pipelines blocks insecure code before builds and deployments proceed.
fromMedium
8 months ago
Information security

From Jenkins to GitHub Actions: Evolving a Secure DevSecOps Pipeline with Canary Deployments

#supply-chain-attacks
fromInfoQ
1 week ago
Information security

TanStack Details Sophisticated npm Supply Chain Attack That Compromised 42 Packages

Information security
fromSecurityWeek
1 week ago

Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack

A compromised NPM maintainer account published malicious package versions that triggered multi-stage credential theft and persistence across CI environments and developer tooling.
Information security
fromnews.bitcoin.com
1 week ago

GitHub Worm Hits npm Packages With 16M Downloads

A GitHub Actions cache poisoning attack enabled malicious npm packages to pass provenance checks, while a dead-man’s switch wipes developer machines if the npm token is revoked.
Information security
fromInfoQ
1 week ago

TanStack Details Sophisticated npm Supply Chain Attack That Compromised 42 Packages

A supply-chain attack poisoned GitHub Actions caches and workflows to publish malicious npm package versions, stealing credentials and propagating malware without npm credential compromise.
Information security
fromInfoWorld
2 weeks ago

Mistral AI SDK, TanStack Router hit in npm software supply chain attack

Automated Mini Shai-Hulud worm attacks rapidly spread through package ecosystems on May 11 by hijacking release pipelines via pull_request_target and maintainer misconfigurations.
Information security
fromThe Hacker News
1 week ago

GitHub Actions Supply Chain Attack Redirects Tags to Steal CI/CD Credentials

Compromised GitHub Actions workflows use imposter commits to steal CI/CD credentials and exfiltrate them to attacker-controlled servers.
#cicd-security
DevOps
fromInfoQ
2 weeks ago

How GitHub Is Securing Agentic Workflows in Modern CI CD Systems

GitHub secures agentic CI/CD workflows using defense-in-depth isolation, constrained permissions and outputs, and audit logging to reduce risks from non-deterministic agents.
Information security
fromtheregister
1 week ago

TanStack weighs invitation-only pull requests after supply chain attack

A GitHub Actions misconfiguration enabled a worm to poison shared cache and extract secrets, prompting TanStack to tighten CI and consider invitation-only PRs.
DevOps
fromInfoQ
2 weeks ago

How GitHub Is Securing Agentic Workflows in Modern CI CD Systems

GitHub secures agentic CI/CD workflows using defense-in-depth isolation, constrained permissions and outputs, and audit logging to reduce risks from non-deterministic agents.
Information security
fromtheregister
1 week ago

OpenAI caught in TanStack npm supply chain chaos after employee devices compromised

Attackers exfiltrated limited internal credentials from two employee devices, prompting OpenAI to rotate signing certificates and require software updates.
Information security
fromTNW | Openai
2 weeks ago

OpenAI says no user data was touched in the TanStack npm worm

Malicious TanStack npm packages were published via the legitimate release pipeline after a hijacked GitHub Actions runner exfiltrated an OIDC token mid-build.
Information security
fromtheregister
2 weeks ago

Cache-poisoning caper turns TanStack npm packages toxic

Eighty-four malicious TanStack npm package versions stole credentials, self-propagated, and wiped disks after poisoning GitHub Actions caches and extracting npm OIDC tokens.
#gemini-cli
DevOps
fromTheregister
3 weeks ago

Google fixes CVSS 10.0 vulnerability in Gemini CLI

Google patched a CVSS 10.0 vulnerability in Gemini CLI, warning users to review workflows in headless mode or GitHub Actions.
fromZDNET
7 months ago
Software development

Google's new Jules Tools is very cool - how I'm using it and other Gemini AI CLIs

DevOps
fromTheregister
3 weeks ago

Google fixes CVSS 10.0 vulnerability in Gemini CLI

Google patched a CVSS 10.0 vulnerability in Gemini CLI, warning users to review workflows in headless mode or GitHub Actions.
fromZDNET
7 months ago
Software development

Google's new Jules Tools is very cool - how I'm using it and other Gemini AI CLIs

#ai-security
fromSecurityWeek
1 month ago
Information security

Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments

Information security
fromTNW | Anthropic
1 month ago

Anthropic, Google, and Microsoft paid AI agent bug bounties, then kept quiet about the flaws

Aonan Guan exploited prompt injection attacks to hijack AI agents from Anthropic, Google, and Microsoft, stealing sensitive API keys and tokens.
Information security
fromTheregister
1 month ago

Anthropic, Google, Microsoft paid AI bug bounties - quietly

Security researchers exploited prompt injection attacks on AI agents to steal sensitive data without vendor disclosure of vulnerabilities.
Information security
fromSecurityWeek
1 month ago

Claude Code, Gemini CLI, GitHub Copilot Agents Vulnerable to Prompt Injection via Comments

A prompt injection attack method named 'Comment and Control' targets AI code security tools, allowing attackers to hijack AI agents using crafted GitHub comments.
Information security
fromTNW | Anthropic
1 month ago

Anthropic, Google, and Microsoft paid AI agent bug bounties, then kept quiet about the flaws

Aonan Guan exploited prompt injection attacks to hijack AI agents from Anthropic, Google, and Microsoft, stealing sensitive API keys and tokens.
Information security
fromTheregister
1 month ago

Anthropic, Google, Microsoft paid AI bug bounties - quietly

Security researchers exploited prompt injection attacks on AI agents to steal sensitive data without vendor disclosure of vulnerabilities.
Node JS
fromDEV Community
2 months ago

I Scanned 10 Popular GitHub Actions Workflows for Undocumented Environment Variables. Here's What I Found.

Many popular JavaScript projects have undocumented environment variables in their GitHub Actions workflows, leading to potential issues for developers forking these projects.
#python
Python
fromMouse Vs Python
4 months ago

How to Switch to ty from Mypy - Mouse Vs Python

Python supports type hinting, but type checking requires external tools like mypy, Pyright, and the new ty.
Python
fromMouse Vs Python
4 months ago

How to Switch to ty from Mypy - Mouse Vs Python

Python supports type hinting, but type checking requires external tools like mypy, Pyright, and the new ty.
#agentic-workflows
fromInfoQ
3 months ago

GitHub Agentic Workflows Unleash AI-Driven Repository Automation

We began GitHub Agentic Workflows as an investigation into a simple question: what does repository automation with strong guardrails look like in the era of AI coding agents? A natural place to start was GitHub Actions, the heart of scalable repository automation on GitHub. GitHub Agentic Workflows leverage LLMs' natural language understanding to let developers define automation goals in simple Markdown files describing the desired outcome.
Software development
fromInfoQ
3 months ago

LinkedIn Leverages GitHub Actions, CodeQL, and Semgrep for Code Scanning

LinkedIn has redesigned its static application security testing pipeline (SAST) to provide consistent, enforceable code scanning across a GitHub-based, multi-repository development environment. The initiative was a result of the company's shift-left strategy by delivering fast, reliable, and actionable security feedback directly in pull requests, strengthening the security of LinkedIn's code and infrastructure and helping protect members and customers.
Information security
Tech industry
fromTheregister
3 months ago

Azure outages ripple across multiple dependent services

Azure experienced two separate service outages affecting Virtual Machine management operations and Managed Identity across East and West US, disrupting numerous dependent services.
Software development
fromInfoWorld
4 months ago

GitHub Artifact Attestations sign and verify software artifacts

Artifact Attestations in GitHub Actions is now generally available to secure artifacts and verify provenance using Sigstore, Kubernetes Policy Controller, and gh attestation verify.
fromMouse Vs Python
4 months ago

How to Switch to ty from Mypy - Mouse Vs Python

The newest type checker on the block is Astral's ty, the maker of Ruff. Ty is another super-fast Python utility written in Rust. To install ty with uv, run the following: uv tool install ty@latest If you do not want to use uv, you can use the standalone installer. Instructions vary depending on your platform, so it is best to refer to the documentation for the latest information. Note: Technically, you can use pip or pipx to install ty as well.
Python
DevOps
fromStephane's Blog
4 months ago

Automating TLS Certificate Monitoring with GitHub Actions, certificate_watcher, and Slack

Combine certificate_watcher with a weekly GitHub Actions workflow and Slack notifications to monitor SSL/TLS certificate expirations serverlessly using a Git-hosted hosts list.
#cicd
#self-hosted-runners
#supply-chain
Software development
fromInfoWorld
5 months ago

10 MCP servers for devops

Model Context Protocol enables AI assistants to perform multi-step devops tasks—Git, CI/CD, IaC, observability—via standardized servers like GitHub's MCP.
#zig
#git-sync
#sbom
Information security
fromMedium
8 months ago

From Jenkins to GitHub Actions: Evolving a Secure DevSecOps Pipeline with Canary Deployments

Migrate CI to GitHub Actions, enhance secrets security, adopt canary progressive delivery, and expose apps via Ingress to create a modern, resilient GitOps CI/CD pipeline.
Information security
fromfaun.pub
8 months ago

From Jenkins to GitHub Actions: Evolving a Secure DevSecOps Pipeline with Canary Deployments

Migrate CI to GitHub Actions, strengthen security and secrets management, adopt canary progressive delivery, and expose applications via NGINX Ingress for scalable DevSecOps pipelines.
Software development
fromGitHub
8 months ago

GitHub - azat-io/actions-up: Interactive CLI tool to update GitHub Actions to latest versions with SHA pinning

Automatically discover, update, and SHA-pin GitHub Actions across workflows for secure, reproducible CI with interactive batch updates and CI integration.
DevOps
fromInfoQ
9 months ago

AWS Lambda Adds Support for GitHub Actions

AWS Lambda supports GitHub Actions for declarative, OIDC-authenticated deployments of functions via .zip or container images, including S3 support and configurable function settings.
Software development
fromRealpython
11 months ago

Python Continuous Integration and Deployment Using GitHub Actions - Real Python

GitHub Actions is essential for Python developers to automate workflows and adapt software projects to evolving demands.
[ Load more ]