Tag

#ci-cd

Tagged “ci-cd”

28 articles

Your DevOps platform's real bill is not on the invoice

A new GitLab post walks through what actually adds up to a DevOps platform's total cost of ownership. The subscription line is the easy part; the variable compute, the AI usage and the engineer-hours are where teams keep getting surprised.

Sep 13, 2026 · Priya Nair Platform engineering

GitLab's Co-Create recap lands W3C trace context and merge-train limits in CI/CD

GitLab's half-year Co-Create program recap flags three shipped CI/CD changes: new W3C Trace Context variables in pipeline jobs, configurable merge-train pipeline limits, and a REST API for Terraform state protection rules.

Sep 13, 2026 · Maya Okonkwo Security & supply chain

GitLab's critical patch: unauth file read from the commits API

GitLab 19.3.2, 19.2.6 and 19.1.8 ship eighteen CVEs' worth of fixes, including a Critical unauthenticated arbitrary-file read on the repository commits API. Self-managed operators have a downtime problem stacked on top of a rotate-your-CI-variables problem.

Sep 11, 2026 · Tomás Vega Supply chain security

The sandbox you thought was closed

The New Stack uses a July 16 intrusion at Hugging Face to name a security category that has been forming for a year: an AI agent breaking out of its containment. For CI/CD teams giving agents build-time access, the sandbox is one control, not the whole boundary.

Aug 25, 2026 · Tomás Vega Code quality & testing

AI writes releases faster than your test rig can pretend to grade them

A DevOps.com column locates the real bottleneck of AI-generated code at release verification, and warns against letting one model both write and grade its own changes.

Aug 17, 2026 · Tomás Vega Security & supply chain

The next scanner in your pipeline is an autonomous agent. Ask where it runs.

A devops.com opinion piece argues CI/CD security testing is going autonomous: proof-based agents that chain vulnerabilities the way an attacker would. The real design fight is whether those agents run inside your trust boundary or ship your source and secrets to somebody else's.

Aug 16, 2026 · Tomás Vega Developer experience

GitHub's Dependabot playbook: group the version PRs, slow the cadence, keep security fast

A GitHub blog post dated 2026-07-29 lays out the three-lever config for making Dependabot survivable on a busy repo: group version updates into one PR, slow the schedule to weekly or monthly, and let security updates keep flowing on their own timing. It is a few lines of YAML that turn a bot most teams half-mute back into something they can triage.

Aug 14, 2026 · Priya Nair Developer experience

GitHub adds an in-product path off branch protection rules

A GitHub changelog dated 2026-08-11 adds a one-click conversion from legacy branch protection rules into repository rulesets, done inside repo settings. If you have been putting off the migration across a fleet of repos, the tax on doing it just dropped.

Aug 14, 2026 · Priya Nair Security & supply chain

GitLab's mid-month patch train fixes a CI/CD pipeline authorization bypass

GitLab shipped 19.2.2, 19.1.4 and 19.0.6 with 13 CVEs, including an authorization bypass that let developer-role users run CI pipelines against protected branches. Self-managed operators should upgrade immediately.

Aug 13, 2026 · Maya Okonkwo Developer experience

GitHub's native stacked pull requests land in public preview

GitHub is rolling out native stacked pull requests in public preview: one big change split into a chain of dependent, layer-sized PRs, with a stack map on each one and a merge that lands every layer beneath the latest ready PR in a single operation. Branch protections and required status checks still apply, merge queue support is coming in over the following weeks, and there is a new gh-stack CLI.

Aug 9, 2026 · Priya Nair Security & supply chain

Auditors, OIDC and the trust policy most teams get wrong

A DevOps.com walkthrough by Artur Yolchyan lays out a SOC 2-shaped CI/CD pipeline on GitHub Actions and AWS: multi-account isolation, OIDC federation locked to one repo and branch, and the same container image retagged all the way to production. The interesting part is not the account topology; it is the one line in the trust policy that decides who can talk to your ECR.

Jul 24, 2026 · Tomás Vega Security & supply chain

Secret scanning custom patterns get a REST API, so you can PR your detectors

GitHub made REST endpoints for secret scanning custom patterns generally available on July 13, 2026. Detectors can now be created, listed, updated and deleted via API at repository, organization and enterprise scope, though dry runs and the final publish step still happen in the UI.

Jul 21, 2026 · Priya Nair Platform engineering

Preview environments were built for humans. The traffic changed.

A new essay reframes preview and staging environments as a traffic-shaped workload rather than a ticket queue, now that coding agents open pull requests in bursts. Platform teams facing agent-speed demand have to treat environment provisioning as capacity planning.

Jul 19, 2026 · Priya Nair Supply-chain security

Cordyceps: when a stranger's pull request runs as a maintainer

Researchers at Novee catalogue Cordyceps, a class of CI/CD supply-chain exploit where pull requests and comments from untrusted contributors get executed with maintainer permissions. A scan of 30,000 high-impact repositories flagged 654 candidates and confirmed over 300 as fully exploitable, with named blast radius inside Microsoft, Google, Apache and Cloudflare.

Jul 16, 2026 · Tomás Vega Incident response

AWS teaches its DevOps Agent to open the pull request too

An AWS DevOps Blog walk-through chains the AWS DevOps Agent with the Kiro CLI so incident findings become a pull request instead of a Slack thread. The pipeline still gates on human approval, but who wrote the diff has changed, and so has what your review is actually catching.

Jul 15, 2026 · Tomás Vega Security & supply chain

GitHub pulls /security-review out of the CLI and into the Copilot app

GitHub's /security-review slash command is now in public preview inside the Copilot app, running a security pass on in-flight code changes before they ever reach a pull request. It is the same review that was already in the Copilot CLI, moved closer to where the code is being written.

Jul 15, 2026 · Tomás Vega Security & supply chain

Datadog says months-long GitHub recon out of dormant 'ghost' accounts is prep for supply-chain attacks

Datadog security researchers say overlapping months-long campaigns have been abusing GitHub's public API and reactivating more than 50 long-dormant accounts to map organizations and their engineers. The setup looks a lot like the reconnaissance phase of a supply-chain intrusion.

Jul 14, 2026 · Maya Okonkwo Supply-chain security

The five-minute SBOM sniff test earns its keep

A quick, deliberate look at the bill of materials for a hardened image catches supply-chain trouble a CVE scanner will never flag. Bolt it into the pipeline, not the compliance report.

Jul 13, 2026 · Tomás Vega Platform engineering

Google puts Cloud Run sandboxes into preview for AI-generated code

Google Cloud has moved Cloud Run sandboxes to public preview, positioning them as a runtime for AI-generated code and untrusted binaries that a pipeline would otherwise be asked to trust with host access and cloud credentials.

Jul 10, 2026 · Maya Okonkwo AI in CI/CD

GitLab shipped a real migration with AI agents and wrote up what actually broke

GitLab's engineering post walks through using its Duo agents to unify two rate-limiting paths across 121 keys and 95 call sites, wrapped in a spec-and-review loop with one honest shadow-mode incident along the way. Here is what a DX-minded reader can lift from it.

Jul 10, 2026 · Priya Nair Supply chain security

npm v12 flips install-time to closed-by-default

npm v12 shipped as latest on July 8, 2026, with lifecycle scripts, git-URL dependencies and remote-URL dependencies all off by default at install time. Alongside it, the 2FA-bypass Granular Access Token starts a two-step retirement that ends direct publishes.

Jul 9, 2026 · Tomás Vega Security & supply chain

setup-java 5.5.0 adds JDK signature verification, if you remember to enable it

GitHub's actions/setup-java 5.5.0 adds opt-in GPG signature verification for downloaded JDKs, plus a Kona distribution parameter and a set of Maven quality fixes. It closes a real supply-chain gap for Java CI jobs, but existing pipelines keep pulling unsigned JDKs until someone flips the switch.

Jul 9, 2026 · Tomás Vega Release engineering

Release gates for LLMs: the argument that your CI is not the finish line

A New Stack piece from Freddy Daniel Alvarez Pinto argues that traditional CI/CD gates are not enough for production AI systems, and proposes a release-gating approach built for LLMs. Here is why the framing matters for pipeline owners, and where the honest rough edges sit.

Jul 6, 2026 · Priya Nair Platform engineering

GitHub sets July 30 as the hard shutdown for GitHub Models

GitHub published a July 1 changelog entry confirming GitHub Models will be fully retired on July 30, 2026. The earlier closure to new customers now has a matching end date, and any pipeline still calling into the service has a fixed migration window of roughly four weeks.

Jul 5, 2026 · Maya Okonkwo Developer experience

The three-hour bug your API tests should have caught

A DevOps.com explainer lays out a three-stage API testing shape that keeps feedback under a quarter of an hour: a smoke pass on every PR, the full suite on merge, and dependency-real integration on staging.

Jul 1, 2026 · Priya Nair Developer experience

When the agent codes in seconds, CI becomes the slow neighbour

A DevOps.com opinion piece argues that the inner loop is where AI coding agents now live, and that pipeline-stage validation, tests, review and standards checks have to follow them in. The verdict from the developer-experience seat: yes, but only if the agent loop inherits the hermeticity CI fought for.

Jun 27, 2026 · Priya Nair Security & supply chain

Homebrew 6.0.0 turns third-party taps into an opt-in trust list

Homebrew 6.0.0 introduces a tap-trust gate that blocks any third-party tap a user has not explicitly approved with brew trust. CI pipelines that install from those taps will need a setup step before the formula resolves.

Jun 23, 2026 · Tomás Vega Release management

AWS pushes its DevOps Agent across the release boundary, in preview

AWS used the AWS New York Summit to preview a release-management capability for its DevOps Agent, extending the agent from incident-diagnostics work into the merge-and-deploy phase of CI/CD pipelines.

Jun 17, 2026 · Maya Okonkwo