#GithubActions
LightNews LightNews
watermelonkode.bsky.social
A practical GitHub Actions tip: use concurrency groups to prevent outdated workflow runs from consuming unnecessary resources. Small CI improvements compound across every pull request. #GitHubActions #Automation #CICD
November 6, 2026 at 2:15 PM
densuke.bsky.social
更新されたよ、見に来てね!→

「はい」の一度が重い日 GPT-6の穴探しと秘密漏洩 あなたの許可リストは? 2026年11月09日(月) https://www.youtube.com/watch?v=DIkPD8QD0ts
#ClaudeCode #GPT6Cyber #Firefox #GitHubActions #AsahiLinux
November 8, 2026 at 9:50 PM
densuke.bsky.social
更新されたよ、見に来てね!→

【公開GitHubの1122ファイルにパスワードとキー】「はい」の一度が重い日 GPT-6の穴探しと秘密漏洩 あなたの許可リストは? 26/11/09(月) https://www.youtube.com/shorts/HDtWwM1z9ok
#ClaudeCode #GPT6Cyber #Firefox #GitHubActions #AsahiLinux
November 8, 2026 at 10:40 PM
tellerstech.bsky.social
GitHub Blocks pull_request_target by Default: Check Workflows #github #githubactions #devops #sre

This is a clip from our recent Ship It Weekly Podcast episode.
Visit shipitweekly.fm or link in bio to listen to the full episode!
November 7, 2026 at 5:53 PM
saimul.bsky.social
GhostAction targeted 30,000+ GitHub repos in October with a fake "Security Audit" workflow (GitGuardian).

Revoke the stolen credential, not just the secrets. Then lock your actions: gh actions-lock

Search for security-audit.yml today.

Follow for more.

#GitHubActions
Five terminal commands to lock your CI after GhostAction: check your workflows and the commits that touched them, list the secrets to rotate, write the Actions lockfile and verify it.
November 8, 2026 at 2:03 AM
kadet-hub.bsky.social
Kyverno Chainsaw e2e tests that fail fast on a broken pod #KadetHub #Kapitan #Chainsaw #kind #GitHubActions
Kyverno Chainsaw e2e tests that fail fast on a broken pod
Kubernetes end-to-end testing with Kyverno Chainsaw on kind in GitHub Actions: six Kapitan recipes, a fail-fast pod watcher, webhook races, measured timeouts.
kadet-hub.org
November 8, 2026 at 9:24 PM
hackernoon.com
Learn how to make GitHub Actions scheduled workflows more reliable with automated QA, Slack reporting, duplicate prevention, and watchdog monitoring. #githubactions
Your GitHub Actions Cron Job Can Disappear Without Failing
hackernoon.com
November 4, 2026 at 10:00 AM
stackflag.bsky.social
CVE-2022-24066 - simple-git
The simple-git library used in several projects can be tricked into executing code that an attacker controls. This could allow unauthorized actions on your systems.…

Too many irrelevant or confusing CVEs? Use stackflag.com

#simplegit #GitHubActions #npm #CVE #infosec
CVE-2022-24066: simple-git may let attackers run unwanted code
The simple-git library used in several projects can be tricked into executing code that an attacker controls.
stackflag.com
November 9, 2026 at 10:50 AM
statusisdown.bsky.social
Codefresh is reportedly down for some users at the moment. Are you one of them? #CodefreshDown #GithubDown #GithubActions https://statusisdown.com/service/codefresh/
Is Codefresh down? Live status & outages - Status Is Down
Is Codefresh down right now? Check the latest outage reports and share your experience. Get real-time alerts when Codefresh is down.
statusisdown.com
November 6, 2026 at 12:05 AM
stackflag.bsky.social
CVE-2022-24433 - simple-git
The simple-git library used in GitHub Actions/simple-git, simple-git_project/simple-git, simple-git and @rootio/simple-git had a security weakness that could allow an…

Too many irrelevant or confusing CVEs? Use stackflag.com

#simplegit #GitHubActions #npm #CVE #infosec
CVE-2022-24433: simple-git could let attackers run code
The simple-git library used in GitHub Actions/simple-git, simple-git_project/simple-git, simple-git and @rootio/simple-git had a security weakness that.
stackflag.com
November 9, 2026 at 10:50 AM
watermelonkode.bsky.social
Your CI pipeline should catch problems before they reach production. Automate tests, enforce meaningful quality checks, and make failures easy to understand. Good automation gives small teams room to move faster. #GitHubActions #CICD #DevOps
November 3, 2026 at 6:15 PM
donwebmedia.bsky.social
Cómo armar un revisor de Terraform con IA en CI

Descubrí cómo armar un revisor de Terraform con IA en tu pipeline de CI para dejar de aprobar planes a ciegas: entrá y animate a probarlo ahora.

#terraform #cicd #githubactions #infraestructuracomocódigo
Cómo armar un revisor de Terraform con IA en CI
Un blueprint real para que un LLM lea cada terraform plan contra la política del equipo y comente en el PR, sin credenciales cloud ni poder de aplicar cambios.
donweb.news
November 7, 2026 at 5:27 AM
donwebmedia.bsky.social
Managed Identity vs Service Principal: cuál usar en Azure

¿Managed identity vs service principal en Azure? Mirá cuándo conviene cada uno, los comandos exactos y los errores de caché que rompen el 403 en producc...

#azure #managedidentity #serviceprincipal #githubactions #entraid
Managed Identity vs Service Principal: cuál usar en Azure
La diferencia real entre managed identity y service principal en Azure, con comandos, tabla comparativa y los errores que aparecen después del primer deploy.
donweb.news
November 6, 2026 at 4:24 AM
stackflag.bsky.social
CVE-2021-23406 - pac-resolver
The pac-resolver library used in GitHub Actions and related projects could be tricked into executing unwanted code, potentially affecting your automated…

Too many irrelevant or confusing CVEs? Use stackflag.com

#pacresolver #GitHubActions #npm #CVE #infosec
CVE-2021-23406: pac-resolver package can let bad code run
The pac-resolver library used in GitHub Actions and related projects could be tricked into executing unwanted code, potentially affecting your automated.
stackflag.com
November 6, 2026 at 11:30 AM
tellerstech.bsky.social
GitHub Actions Jobs Move to AWS: Azure-Only Allowlists Can Break #githubactions #aws #devops #sre

This is a clip from our recent Ship It Weekly Podcast episode.
Visit shipitweekly.fm or link in bio to listen to the full episode!
November 3, 2026 at 5:58 PM
umbra-codex.bsky.social
GitHub.com blocks pull_request_target by default on public repos Dec 2. It runs in the base repo with its secrets, so fork code under it is the risk. Brownouts Nov 9 & 16 show what breaks. Find yours: rg pull_request_target .github/workflows

#GitHubActions #DevSecOps
November 3, 2026 at 3:00 PM
infrajump.bsky.social
GitHub Actions will block pull_request_target by default in public repos Dec 2. Brownouts Nov 9/16, 16:00–18:00 UTC, will fail affected runs. Explicit event-policy exceptions remain possible; private/internal repos unaffected. #GitHubActions #DevSecOps
November 3, 2026 at 11:12 AM
dxsrc.org
The Bun Dependabot Gap: Dependabot Alerts Don’t See bun.lock, by @charpeni.bsky.social:

https://charpeni.com/blog/the-bun-dependabot-gap-dependabot-alerts-dont-see-bun-lock?ref=dxsrc.org

#bun #dependencies #dependabot #githubactions #security
The Bun Dependabot Gap: Dependabot Alerts Don't See bun.lock | Nicolas Charpentier
GitHub's dependency graph doesn't read bun.lock yet, so in Bun projects Dependabot alerts only cover what's written in package.json, and never a transitive dependency. Here's how to check if you're affected, and how I closed the gap with a GitHub Action.
charpeni.com
November 6, 2026 at 2:30 PM
zehio.bsky.social
A tag can be moved. A commit SHA can't.
In March 2025 someone repointed the tags of tj-actions/changed-files to a commit that dumped CI secrets into the build logs.
Pin third-party actions by SHA, with the version in a comment.
#GitHubActions #DevSecOps #SupplyChain
A workflow diff that replaces a third-party action pinned to the v3 tag with the same action pinned to a full commit SHA and a # v3.1.0 comment.
November 5, 2026 at 6:24 PM
stackflag.bsky.social
CVE-2022-25912 - simple-git
The simple-git library used in several projects has a security issue that could let an attacker execute unwanted code. Updated versions of the library have been…

Too many irrelevant or confusing CVEs? Use stackflag.com

#simplegit #GitHubActions #npm #CVE #infosec
CVE-2022-25912: simple-git could let attackers run code
The simple-git library used in several projects has a security issue that could let an attacker execute unwanted code.
stackflag.com
November 5, 2026 at 1:30 PM
zehio.bsky.social
Un tag se puede mover. El SHA de un commit, no.
En marzo de 2025 movieron los tags de tj-actions/changed-files a un commit que volcaba los secretos de la CI en el log.
Fija las actions de terceros por SHA, con la versión en un comentario.
#GitHubActions #DevSecOps #SupplyChain
Un diff de un workflow que cambia una action de terceros fijada al tag v3 por la misma action fijada al SHA completo de un commit, con el comentario # v3.1.0.
November 5, 2026 at 9:16 AM
donwebmedia.bsky.social
Mac mini M6 vs runner macOS de GitHub Actions: el benchmark

Clean build 53% mas rapido: el Mac mini M6 contra el runner macOS GitHub Actions, con tiempos, costos y limitaciones reales del benchmark 2026.

#githubactions #macos #xcode #cicd #applesilicon
Mac mini M6 vs runner macOS de GitHub Actions: el benchmark
El Mac mini M6 redujo el clean build un 53% frente al runner hosted de GitHub Actions. Tiempos, costos y limitaciones del benchmark de MacRun 2026.
donweb.news
November 5, 2026 at 12:33 AM
hugovalters.bsky.social
Catch slow CI before it bites. This 269-line Python script pulls your last N GitHub Actions runs and shows where duration and success rate are drifting. Intermediate level. #python #devops #githubactions https://www.valtersit.com/python/github-actions-workflow-run-analyzer/
GitHub Actions Workflow Run Analyzer
www.valtersit.com
November 2, 2026 at 2:50 PM
donwebmedia.bsky.social
Boarding-gate: la cola de prioridad para GitHub Actions

Renovate y Dependabot inundan tu CI de runs inútiles? Boarding-gate ordena la cola de prioridad GitHub Actions por tipo de PR, no por llegada.

#githubactions #renovate #dependabot #cicd #boardinggate
Boarding-gate: la cola de prioridad para GitHub Actions
udondan publicó boarding-gate, una GitHub Action que ordena Renovate, Dependabot y release PRs por prioridad en vez de por orden de llegada.
donweb.news
November 3, 2026 at 6:04 PM