#Github Actions

Another GitHub Actions Outage, and the Ninth in a Month

Today's incident fits a documented reliability slide, just as everything from Pages to Copilot rides on Actions.

Article · 1w ago5

GitHub Actions Has Become GitHub's Single Point of Failure

Today's Actions and Pages outage is GitHub's fifth incident in six days, and the causes look structural.

Article · 1w ago1

Sign and Verify Container Images with Cosign and Sigstore

Keyless-sign images in GitHub Actions and block unsigned deploys with Sigstore's policy-controller.

Tutorial · 1w ago0

Docker Hub Finally Does OIDC, but Only for Paying Orgs

Short-lived federated tokens replace registry PATs in GitHub Actions — unless you're on a free plan.

Article · 1w ago0

Block Malicious npm Packages in CI with Socket.dev

Wire Socket's supply-chain scanner into GitHub Actions to stop typosquats and install scripts before merge.

Tutorial · 1w ago0

npm Breaks Its Oldest Promise to Kill the Worm

GitHub's new defaults across npm and Actions attack every stage of the self-replicating supply chain playbook.

Article · 2w ago4

Block Secrets Before They Hit GitHub with Gitleaks

Set up a Gitleaks pre-commit hook and GitHub Actions check that reject commits containing credentials.

Tutorial · 2w ago0

Catch Jailbreaks in CI with garak, NVIDIA's LLM Red-Team Scanner

Run dozens of adversarial probes against your LLM endpoint on every PR and fail the build on regressions.

Tutorial · 2w ago0

Automate Versioning and Changelogs with Changesets in a pnpm Monorepo

Set up Changesets so every PR carries its own version bump and changelog entry, then let GitHub Actions handle the version PR and npm publish on merge.

Tutorial · 1mo ago0

Build a Claude-Powered GitHub Actions PR Review Bot

Wire the Anthropic API into a GitHub Actions workflow that posts inline code review comments on every pull request, automatically.

Tutorial · 1mo ago0

Miasma Proves Trusted Publishing Can Backfire Spectacularly

The self-propagating Miasma worm exploits GitHub Actions OIDC and phantom build files to turn security standards against developers.

Article · 1mo ago0

The Cordyceps Exploits: Why Your CI/CD Pipelines Are Wide Open

A systemic workflow composition flaw exposes hundreds of major repositories, proving we must stop treating CI/CD as passive configuration.

Article · 1mo ago0

Audit Your Software Supply Chain: Generate an SBOM with Syft and Gate CI on a Grype Vulnerability Scan

Wire Syft and Grype into your pipeline to produce a machine-readable SBOM and break the build the moment a high-severity CVE appears in your dependencies.

Tutorial · 1mo ago0

GitHub Hardens actions/checkout to Block Pwn Request Attacks

The latest security update stops common pipeline exploits but leaves structural CI/CD risks for developers to manage.

Article · 1mo ago0

Catch Risky Code Before It Merges: Add Semgrep SAST to Your GitHub Actions Pipeline

Wire Semgrep into GitHub Actions to scan every pull request against OWASP Top 10 rules and a custom rule you write yourself — so a CI failure blocks the merge before risky code reaches main.

Tutorial · 1mo ago0