Tag

#ci-security

Tagged “ci-security”

6 articles

CodeQL 2.26.3 retunes its Actions queries and drops the self-hosted module

CodeQL 2.26.3 reworks how the engine reasons about GitHub Actions workflows, tightening output-clobbering, cache-poisoning and env-var injection queries and removing the self-hosted runner module. Hosted code scanning is already on the new pack, so the next full run may move alert counts in both directions.

Aug 23, 2026 · Maya Okonkwo Security & supply chain

The arrayref takeover is the crates.io threat model, not a surprise

A DevOps.com report says attackers took over the maintainer account behind the popular Rust crate arrayref and pushed four additional attacker-owned crates carrying information-stealing malware. The more useful question for CI/CD teams is what your build farm did with that code before anyone noticed.

Aug 22, 2026 · Tomás Vega Security & supply chain

Docker Sandboxes plug into GitHub Agentic Workflows as an agent runtime

Docker has published a walk-through of running an AI coding agent inside a Docker Sandbox as part of a GitHub Actions job, with the sandbox microVM, a private Docker daemon and a network allowlist doing the isolation. The example moves the agent's blast radius off the runner and behind a policy the workflow file can see.

Aug 21, 2026 · Tomás Vega Security & supply chain

GitHub Actions hands fork triggers a read-only cache token

GitHub Actions now issues read-only cache tokens to workflow events fired from outside a repository's collaborator set, applying least privilege to the default-branch cache so untrusted triggers cannot poison entries the next push reuses.

Jun 30, 2026 · Tomás Vega Security

actions/checkout v7 refuses fork PR code in pull_request_target

GitHub shipped actions/checkout v7, which fails by default when a workflow triggered by pull_request_target or workflow_run tries to fetch the head of a fork's pull request. Same-repo PRs and the standard pull_request event are unaffected; a deliberately conspicuous opt-out exists for teams who really mean it.

Jun 18, 2026 · Tomás Vega Security & supply chain

GitHub Actions hands platform teams a workflow-trigger allow list

GitHub Actions is rolling out workflow execution protections in public preview at the enterprise, organization, and repository levels, letting administrators define who and what can trigger workflows. It's the platform-owned trigger gate the CI/CD industry has been quietly working toward for years.

Jun 18, 2026 · Tomás Vega