Tag

#github-actions

Tagged “github-actions”

20 articles

Docker Hub gets OIDC federation for GitHub Actions, retiring the PAT-in-a-secret pattern

Docker has added OpenID Connect authentication for GitHub Actions on Team, Business and Docker Hardened Images plans, so workflows push and pull images with a short-lived per-run token instead of a stored Personal Access Token. It closes off one of the last static credentials still sitting in most Actions repos.

Aug 1, 2026 · Maya Okonkwo Security & supply chain

GitHub Actions freezes suspected-malicious workflow runs until a human signs off

GitHub has flipped Actions into a hold-first posture for workflow runs it flags as potentially malicious on public repositories: the run pauses until a collaborator with write access approves it from an authenticated web session. The change targets a wave of credential-theft attacks that push booby-trapped workflow files with stolen tokens.

Jul 28, 2026 · Tomás Vega Security & supply chain

Auditors, OIDC and the trust policy most teams get wrong

A DevOps.com walkthrough by Artur Yolchyan lays out a SOC 2-shaped CI/CD pipeline on GitHub Actions and AWS: multi-account isolation, OIDC federation locked to one repo and branch, and the same container image retagged all the way to production. The interesting part is not the account topology; it is the one line in the trust policy that decides who can talk to your ECR.

Jul 24, 2026 · Tomás Vega Security & supply chain

The npm worm that shipped with valid SLSA provenance

A DevOps.com analysis of the Miasma npm worm makes an uncomfortable case: signing and provenance told the honest truth, and the pipeline still shipped malware. When the build platform itself is the attack surface, a green attestation is a description of the failure, not a defence against it.

Jul 22, 2026 · Tomás Vega Security & supply chain

The workstation is in scope now

A DevOps.com essay argues the laptop that pushes commits belongs inside the supply-chain threat model, citing the Megalodon campaign that injected malicious GitHub Actions workflows into thousands of repositories and a separate malicious VS Code extension incident. What CI-side controls actually catch this, and where the pipeline runs out of leverage.

Jul 19, 2026 · Tomás Vega Runners & infrastructure

Xcode 27 lands on GitHub-hosted runners, and the naming rule quietly changed

GitHub Actions added an Xcode 27 image in public preview on its arm64 macOS runners. The bigger shift is buried in the changelog: images are now keyed to the Xcode major version instead of the OS, one Xcode per image.

Jul 19, 2026 · Priya Nair Supply-chain security

Cordyceps: when a stranger's pull request runs as a maintainer

Researchers at Novee catalogue Cordyceps, a class of CI/CD supply-chain exploit where pull requests and comments from untrusted contributors get executed with maintainer permissions. A scan of 30,000 high-impact repositories flagged 654 candidates and confirmed over 300 as fully exploitable, with named blast radius inside Microsoft, Google, Apache and Cloudflare.

Jul 16, 2026 · Tomás Vega Security & supply chain

setup-java 5.5.0 adds JDK signature verification, if you remember to enable it

GitHub's actions/setup-java 5.5.0 adds opt-in GPG signature verification for downloaded JDKs, plus a Kona distribution parameter and a set of Maven quality fixes. It closes a real supply-chain gap for Java CI jobs, but existing pipelines keep pulling unsigned JDKs until someone flips the switch.

Jul 9, 2026 · Tomás Vega Security & supply chain

Copilot CLI drops the PAT requirement inside GitHub Actions

GitHub says Copilot CLI, when invoked from a GitHub Actions workflow, will now accept the built-in GITHUB_TOKEN. That retires one of the last long-lived personal tokens teams were carrying just to script Copilot from CI.

Jul 4, 2026 · Maya Okonkwo Security & supply chain

GitHub Actions hands fork triggers a read-only cache token

GitHub Actions now issues read-only cache tokens to workflow events fired from outside a repository's collaborator set, applying least privilege to the default-branch cache so untrusted triggers cannot poison entries the next push reuses.

Jun 30, 2026 · Tomás Vega Runners & infrastructure

GitHub-hosted larger runners pick up RHEL 9 and RHEL 10 in public preview

GitHub's larger hosted runners now offer Red Hat Enterprise Linux 9 and 10 images in public preview, a partnership with Red Hat aimed at shops that have been self-hosting Actions just to keep production-like CI on Red Hat.

Jun 29, 2026 · Maya Okonkwo Runners & infrastructure

GitHub lets org admins switch off the default hosted runner labels

Organizations on Actions can now disable standard hosted runner labels such as `ubuntu-latest` at the org level, per the June 25 changelog. The toggle turns the default runner pool from an implicit allowlist into a catalogue platform teams have to maintain.

Jun 28, 2026 · Maya Okonkwo Platform engineering

GitHub Actions adds a background marker, and the linear job stops being the only shape

GitHub Actions now lets steps inside a job run concurrently with a 'background' marker plus 'wait', 'cancel' and 'parallel' helpers, breaking the sequential-only model that has defined Actions jobs since launch.

Jun 26, 2026 · Priya Nair Platform engineering

A self-hosted Kubernetes diagnostic agent shipped by GitOps: the CNCF walkthrough

A CNCF blog post lays out a read-only, in-cluster AI agent whose CI/CD chain runs entirely on GitHub Actions and Argo CD Image Updater, with no data leaving the cluster and no cloud AI provider in the loop.

Jun 25, 2026 · Maya Okonkwo Runners & infrastructure

GitHub Actions lets custom runner images stack on other custom images

Custom images for GitHub-hosted runners can now be built on top of other custom images, per the June 18 changelog. The shift turns runner provisioning into a layered chain that platform teams can govern the same way they manage container base images.

Jun 19, 2026 · Maya Okonkwo Security

actions/checkout v7 refuses fork PR code in pull_request_target

GitHub shipped actions/checkout v7, which fails by default when a workflow triggered by pull_request_target or workflow_run tries to fetch the head of a fork's pull request. Same-repo PRs and the standard pull_request event are unaffected; a deliberately conspicuous opt-out exists for teams who really mean it.

Jun 18, 2026 · Tomás Vega Security & supply chain

GitHub Actions hands platform teams a workflow-trigger allow list

GitHub Actions is rolling out workflow execution protections in public preview at the enterprise, organization, and repository levels, letting administrators define who and what can trigger workflows. It's the platform-owned trigger gate the CI/CD industry has been quietly working toward for years.

Jun 18, 2026 · Tomás Vega Security & supply chain

Pinning every CI action to a commit SHA is becoming the new minimum

A new write-up from the Cilium maintainers lays out a concrete playbook for locking down CI/CD dependencies, full-SHA pinning for every action, digest-pinned containers, vendored Go modules, and Renovate with a release-age cooldown. The pattern matters even if you do not ship eBPF for a living.

Jun 16, 2026 · Tomás Vega Security & supply chain

GitHub Agentic Workflows drop personal access tokens for the built-in Actions token

Agentic workflows on GitHub can now authenticate with the ephemeral GITHUB_TOKEN instead of a long-lived personal access token. It is a quiet credential-hygiene win that closes one of the messier blast radii in agent-driven CI.

Jun 15, 2026 · Tomás Vega Runners & infrastructure

GitHub Actions resumes self-hosted runner version enforcement

Self-hosted runners must register on 2.329.0 or later and install each new release within 30 days, with full enforcement landing September 25, 2026 on github.com. The change moves runner version management from a hygiene task into a fleet-inventory problem.

Jun 15, 2026 · Maya Okonkwo