#githubactions — Public Fediverse posts

Your CI/CD pipeline is only as secure as the random code you copied from the Marketplace. Supply chain attacks are thriving on GitHub Actions. Here's how to lock it down. #DevSecOps #GitHubActions #Security

https://www.valtersit.com/guides/gitlab/github-actions-your-pipeline-is-only-as-secure as-the-random-code-you-copied/

via @dotnet : Test reporting in Microsoft.Testing.Platform: from red build to root cause

https://ift.tt/Pmqt8rZ
#MTP #MicrosoftTestingPlatform #TestReporting #dotnet #CI #GitHubActions #AzureDevOps #MSTest #NUnit #xUnit #TUnit #Expecto #testreports #TRX #HTMLRep…

via @dotnet : Test reporting in Microsoft.Testing.Platform: from red build to root cause

https://ift.tt/Pmqt8rZ
#MTP #MicrosoftTestingPlatform #TestReporting #dotnet #CI #GitHubActions #AzureDevOps #MSTest #NUnit #xUnit #TUnit #Expecto #testreports #TRX #HTMLRep…

🚨 Oh no, GitHub Actions had a nap! 💤 Apparently, coders had to endure the horror of actually thinking for themselves for a whole... few hours! 😱 But don't worry, you can now subscribe to email updates so you won't miss the thrilling moment when it goes down again! 📧🙄
https://www.githubstatus.com/uptime/br0l2tvcx85d #GitHubActions #GitHubDown #CodingStruggles #EmailUpdates #DevHumor #HackerNews #ngated

🚨 Oh no, GitHub Actions had a nap! 💤 Apparently, coders had to endure the horror of actually thinking for themselves for a whole... few hours! 😱 But don't worry, you can now subscribe to email updates so you won't miss the thrilling moment when it goes down again! 📧🙄
https://www.githubstatus.com/uptime/br0l2tvcx85d #GitHubActions #GitHubDown #CodingStruggles #EmailUpdates #DevHumor #HackerNews #ngated

GitHub Actions suffers second-longest major outage in its history

https://www.githubstatus.com/uptime/br0l2tvcx85d

Comments: https://news.ycombinator.com/item?id=49203184

#HackerNews #GitHubActions #outage #downtime #technews #softwaredevelopment

GitHub Actions suffers second-longest major outage in its history

https://www.githubstatus.com/uptime/br0l2tvcx85d

Comments: https://news.ycombinator.com/item?id=49203184

#HackerNews #GitHubActions #outage #downtime #technews #softwaredevelopment

🚨 GitHub Actions is down! #Panic ensues as #developers are forced to remember how to code without them. 📉 Meanwhile, the internet struggles to figure out how to restart a service without an OTP or CAPTCHA 🤖—truly a test of survival #skills.
https://www.githubstatus.com/incidents/qcvjkzcs7j74 #GitHubActions #Down #Coding #InternetOutage #RestartService #SurvivalSkills #HackerNews #ngated

🚨 GitHub Actions is down! #Panic ensues as #developers are forced to remember how to code without them. 📉 Meanwhile, the internet struggles to figure out how to restart a service without an OTP or CAPTCHA 🤖—truly a test of survival #skills.
https://www.githubstatus.com/incidents/qcvjkzcs7j74 #GitHubActions #Down #Coding #InternetOutage #RestartService #SurvivalSkills #HackerNews #ngated

Disrupting Supply Chain Attacks on npm and GitHub Actions, by @gregose and @steiza:

https://github.blog/security/supply-chain-security/disrupting-supply-chain-attacks-on-npm-and-github-actions/?ref=frontenddogma.com

#npm #githubactions #security #linklists

Disrupting Supply Chain Attacks on npm and GitHub Actions, by @gregose and @steiza:

https://github.blog/security/supply-chain-security/disrupting-supply-chain-attacks-on-npm-and-github-actions/?ref=frontenddogma.com

#npm #githubactions #security #linklists

From the Leanpub Blog: The Leanpub Podcast 🎙 Feat. MaxGuernseyIII, Author of No Direction: The Severed World, Book One

https://leanpub.com/blog/the-leanpub-podcast-feat-maxguernseyiii-author-of-no-direction/

#books #leanpublishing #selfpublishing #serialfiction #fantasynovel #leanpub #githubactions #bookmarketing #writingcommunity #AIwriting #indieauthor #worldbuilding

From the Leanpub Blog: The Leanpub Podcast 🎙 Feat. MaxGuernseyIII, Author of No Direction: The Severed World, Book One

https://leanpub.com/blog/the-leanpub-podcast-feat-maxguernseyiii-author-of-no-direction/

#books #leanpublishing #selfpublishing #serialfiction #fantasynovel #leanpub #githubactions #bookmarketing #writingcommunity #AIwriting #indieauthor #worldbuilding

NEW! The Leanpub Podcast 🎙 Feat. MaxGuernseyIII, Author of No Direction: The Severed World, Book One

https://youtu.be/zITuTbLWQFI

#books #leanpublishing #selfpublishing #serialfiction #fantasynovel #leanpub #githubactions #bookmarketing #writingcommunity #AIwriting #indieauthor #worldbuilding

NEW! The Leanpub Podcast 🎙 Feat. MaxGuernseyIII, Author of No Direction: The Severed World, Book One

https://youtu.be/zITuTbLWQFI

#books #leanpublishing #selfpublishing #serialfiction #fantasynovel #leanpub #githubactions #bookmarketing #writingcommunity #AIwriting #indieauthor #worldbuilding

أصدرت Gitea Runner 3.0.0 دعماً أصلياً لعمليات التخزين المؤقت والأعمال الفنية القياسية لإجراءات GitHub، مما يلغي الحاجة إلى نسخة gitea-upload-artifact. كما عززت الأمان بمسح خيارات Docker غير الآمنة في سير العمل غير المميزة، وفرضت قاعدة عملية واحدة لكل ملف .runner لمنع إلغاء المهام بسبب تضارب بيانات الاعتماد.

#Gitea #GitHubActions

Docker OIDC connections for GitHub Actions available for Docker Orgs
#Docker #Products #DockerHub #Githubactions #Oidcconnections #Security #Softwaresupplychainsecurity

https://www.docker.com/blog/docker-oidc-connections-for-github-actions-available-for-docker-orgs/

Docker OIDC connections for GitHub Actions available for Docker Orgs
#Docker #Products #DockerHub #Githubactions #Oidcconnections #Security #Softwaresupplychainsecurity

https://www.docker.com/blog/docker-oidc-connections-for-github-actions-available-for-docker-orgs/

"if GitHub is saying anything, then _on average_, they are saying 'Actions is experiencing degraded availability'" - me just now

#github #githubactions #githubdown

"if GitHub is saying anything, then _on average_, they are saying 'Actions is experiencing degraded availability'" - me just now

#github #githubactions #githubdown

🔒 Ah yes, the GitHub Blog provides a revolutionary guide to protect your open-source projects by suggesting you, um, use GitHub Actions to prevent attacks on GitHub Actions. 🚀 Because nothing says "security" like blindly trusting the very service you need protection from. 🤖
https://github.blog/security/supply-chain-security/disrupting-supply-chain-attacks-on-npm-and-github-actions/ #GitHubActions #OpenSourceSecurity #CyberSecurity #TrustIssues #TechHumor #HackerNews #ngated

🔒 Ah yes, the GitHub Blog provides a revolutionary guide to protect your open-source projects by suggesting you, um, use GitHub Actions to prevent attacks on GitHub Actions. 🚀 Because nothing says "security" like blindly trusting the very service you need protection from. 🤖
https://github.blog/security/supply-chain-security/disrupting-supply-chain-attacks-on-npm-and-github-actions/ #GitHubActions #OpenSourceSecurity #CyberSecurity #TrustIssues #TechHumor #HackerNews #ngated

Disrupting supply chain attacks on NPM and GitHub Actions

https://github.blog/security/supply-chain-security/disrupting-supply-chain-attacks-on-npm-and-github-actions/

Comments: https://news.ycombinator.com/item?id=49096427

#HackerNews #supplychain #security #NPM #GitHubActions #cybersecurity #threatprevention

Disrupting supply chain attacks on NPM and GitHub Actions

https://github.blog/security/supply-chain-security/disrupting-supply-chain-attacks-on-npm-and-github-actions/

Comments: https://news.ycombinator.com/item?id=49096427

#HackerNews #supplychain #security #NPM #GitHubActions #cybersecurity #threatprevention

More fork drama ensuing as was to be expected:

https://github.com/flathub-infra/documentation/pull/641

Also, thanks for highlighting the existence of
https://flatpark.org/

People hosting their own flatpak repos for their apps is increasing as it appears to me too.

Luckily the format, tooling and docs for this are pretty useful and enable easy publication straight from Github actions or the likes. Compared to Flathub a rather pleasant experience.

Now what'd be great would be a (forge based) discovery mechanism for self hosted flatpak repos.

#fossdrama #flatpak #flatpark #flathub #foss #opensource #llm #selfhosting #fork #github #githubactions

More fork drama ensuing as was to be expected:

https://github.com/flathub-infra/documentation/pull/641

Also, thanks for highlighting the existence of
https://flatpark.org/

People hosting their own flatpak repos for their apps is increasing as it appears to me too.

Luckily the format, tooling and docs for this are pretty useful and enable easy publication straight from Github actions or the likes. Compared to Flathub a rather pleasant experience.

Now what'd be great would be a (forge based) discovery mechanism for self hosted flatpak repos.

#fossdrama #flatpak #flatpark #flathub #foss #opensource #llm #selfhosting #fork #github #githubactions

#GitHubActions appears to silently truncate concurrency.group values. Naturally, this is also completely undocumented as far as I can tell.

Signed, someone who spent quite a while trying to identify why some matrix cells were getting cancelled for "no reason" 🤬

(Side whine: one reason those values were so long is the original version of the workflow was probably vibe coded...)

#GitHubActions appears to silently truncate concurrency.group values. Naturally, this is also completely undocumented as far as I can tell.

Signed, someone who spent quite a while trying to identify why some matrix cells were getting cancelled for "no reason" 🤬

(Side whine: one reason those values were so long is the original version of the workflow was probably vibe coded...)

GitHub Actions became an attacker’s disposable scanner fleet. https://www.developer-tech.com/news/github-actions-abuse-packagist-repositories-into-scanners/ #devsecops #githubactions #packagist #cybersecurity #developers #infosec #technology

GitHub Actions became an attacker’s disposable scanner fleet. https://www.developer-tech.com/news/github-actions-abuse-packagist-repositories-into-scanners/ #devsecops #githubactions #packagist #cybersecurity #developers #infosec #technology

CI/CD pipelines are a prime target for supply chain attacks. We hardened the GitHub Actions workflows for Composer, Packagist and Private Packagist with zizmor, a static analysis tool for GitHub Actions. 🌈

Our new blog post covers what zizmor catches, our configuration, and the pitfalls we hit along the way:
https://blog.packagist.com/securing-our-github-actions-workflows-with-zizmor/

#php #phpc #composerphp #github #githubactions #supplychainsecurity

CI/CD pipelines are a prime target for supply chain attacks. We hardened the GitHub Actions workflows for Composer, Packagist and Private Packagist with zizmor, a static analysis tool for GitHub Actions. 🌈

Our new blog post covers what zizmor catches, our configuration, and the pitfalls we hit along the way:
https://blog.packagist.com/securing-our-github-actions-workflows-with-zizmor/

#php #phpc #composerphp #github #githubactions #supplychainsecurity

Your GitHub Actions runner VM is building from last week's dirty state. One compromised dependency later, your private cloud is owned. Here's how ephemeral Kubernetes runners fix the isolation gap without killing build speed. #DevSecOps #GitHubActions #Kubernetes

https://www.valtersit.com/guides/gitlab/self-hosted_ci_runners-security_vs_performance_in_the_private_cloud/

☔️ 梅雨なのでLINEに天気通知を自動送信する仕組みを作ってみた【完全無料】
https://qiita.com/keishin_nishiura/items/64862bd19bc8b6976b18?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #天気 #Webhook #linebot #LINEmessagingAPI #GitHubActions

スケジュール実行で実現 - Qiita記事の予約投稿システム（第3回：予約投稿編）
https://qiita.com/RYA234/items/80f547a8a7bde9b0041d?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #GitHub #cron #自動化 #GitHubActions

🏃 jonico/awesome-runners

A curated list of awesome self-hosted GitHub Action runners in a large comparison matrix

Compares self-hosted GitHub Action runner solutions in a detailed matrix with features like scaling, architecture, and costs

⭐ Stars: 882
📅 Last Update: Jul 10, 2026

https://github.com/jonico/awesome-runners

#selfhosted #homelab #selfhost #selfhosting #opensource #githubactions

That GitHub Action you copied from the Marketplace? It just shipped a crypto miner to production. Your supply chain is only as secure as the random code you didn't read. Here's how to fix it. #GitHubActions #DevSecOps #Security

https://www.valtersit.com/guides/gitlab/github-actions-your-pipeline-is-only-as-secure as-the-random-code-you-copied/

https://winbuzzer.com/2026/07/09/gitlost-prompt-injection-can-leak-github-private-repos-xcxwbn/

A look at GitLost, the GitHub Agentic Workflows prompt-injection case where public issue text, private repo access, and public comments collide.

#AI #GitLost #GitHub #GitHubActions #PromptInjection #AIAgents #AgenticAI #AISecurity #GitHubCopilot #Cybersecurity

https://winbuzzer.com/2026/07/09/gitlost-prompt-injection-can-leak-github-private-repos-xcxwbn/

A look at GitLost, the GitHub Agentic Workflows prompt-injection case where public issue text, private repo access, and public comments collide.

#AI #GitLost #GitHub #GitHubActions #PromptInjection #AIAgents #AgenticAI #AISecurity #GitHubCopilot #Cybersecurity

https://winbuzzer.com/2026/07/08/novee-says-cordyceps-can-expose-github-actions-secrets-xcxwbn/

Cybersecurity firm Novee has identified a GitHub Actions workflow-chain risk that can expose secrets even when checks pass, affecting hundreds of software repositories.

#GitHubActions #Cybersecurity #CyberThreats #DataSecurity #GitHub #Microsoft

https://winbuzzer.com/2026/07/08/novee-says-cordyceps-can-expose-github-actions-secrets-xcxwbn/

Cybersecurity firm Novee has identified a GitHub Actions workflow-chain risk that can expose secrets even when checks pass, affecting hundreds of software repositories.

#GitHubActions #Cybersecurity #CyberThreats #DataSecurity #GitHub #Microsoft

📣🚨 Researchers demonstrate #GitLost, a prompt injection vulnerability that made GitHub’s AI agent expose private repo data through a crafted public issue and guardrail failures.

Listen to this news: https://hackread.com/gitlost-github-ai-agent-leaking-repository-data/

#GitHub #GitHubActions #AI #Cybersecurity #Vulnerability

📣🚨 Researchers demonstrate #GitLost, a prompt injection vulnerability that made GitHub’s AI agent expose private repo data through a crafted public issue and guardrail failures.

Listen to this news: https://hackread.com/gitlost-github-ai-agent-leaking-repository-data/

#GitHub #GitHubActions #AI #Cybersecurity #Vulnerability

Huh... I forked a #Github repository and then pushed my own branch there, and that caused some Github Actions to run. The actions were defined in the upstream repository, and I didn't even notice them at first.

Makes me wonder if this can be abused to run malicious actions under my account. "First 100 people to open a PR in my repo win $100!" and then put a Github workflow in that repo that steals credentials or whatever. I mean, who reviews a repo before forking it?

#security #GithubActions

GitHub Actionsのcronは何分遅れる？実運用で気づいたCloud Schedulerとの違い
https://qiita.com/re-watanabe/items/2a3bb185cd9e1efec333?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #cron #cloudscheduler #GitHubActions #GoogleCloud #CloudRun

It scans 8 live DMV sources weekly (Smithsonian, Kennedy Center, NPS, MD State Parks, DC Parks & Rec, Songkick concerts + more), filters for new events in the next 14 days, and saves a clean briefing to Apple Notes automatically. Zero ongoing cost. Open source. https://github.com/Shoesmith-Life-Cycle-LLC/dc-monthly-events-automation #DMV #OpenSource #GitHubActions #AppleShortcuts #LocalEvents

We love #githubactions. I can't even call this PR "workflow touchups" anymore, I have to rename it "workflow refactoring".

https://github.com/travier/fedora-atomic-desktops-sealed/pull/39

On the plus side, I think I actually fixed quite a lot now.

#linux #fedora #bazzite #github #immutable

【CDK for Go】GitHub Actions OIDC + CDKで最小権限デプロイロールを設計
https://qiita.com/umekikazuya/items/a090e25a9cb9cfd7540a?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items

#qiita #Go #AWS #IAM #GitHubActions #CDK

via @dotnet : MCP Beyond the Chat Window: Build Diagnostics in CI

https://ift.tt/azRNoku
#mcp #binlog #ci #githubactions #dotnet #msbuild #diagnostics #binlogtools #buildfailureanalysis #prcomments #automation #aiassistance #continuousintegration #binlogserver #…