CI/CD Pipelines

19+ hour, 32+ min ago   (979+ words) Corporate firewalls are rarely all-or-nothing. They are usually the result of a proxy policy, a TLS inspection rule, or a category filter that someone applied years ago and forgot about. That is why you can end up in a situation…...

4+ day, 1+ hour ago   (157+ words) Installation tokens still start with the ghs_ prefix, but they’re now about 520 characters long instead of 40. Token permissions, repository scoping, the one-hour expiration, and the installation access token REST API endpoint are unchanged. Tokens minted before the change continue to work…...

4+ day, 4+ hour ago   (336+ words) TL;DR: I added the concurrency feature with cancel-in-progress to the CI and E2E GitHub Actions workflows of the lavanderia-crm repo. This prevents overlapping runs on the same branch/PR, cutting down wasted minutes and keeping the pipeline fast. Our CI…...

5+ day, 5+ hour ago   (136+ words) Actions retention now covers checks, runs, and statuses The GitHub Blog As previously announced, checks, workflow runs, and statuses are now governed by the same GitHub Actions retention setting that controls how long artifacts and logs are kept. These records…...

1+ week, 2+ day ago   (444+ words) On September 15, 2026, GitHub turned off SHA-1 for HTTPS and TLS on github.com and its CDNs. They had been warning about it since April. If your client can't do a TLS handshake without SHA-1, you now get a connection error....

1+ week, 3+ day ago   (431+ words) Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code. According to researchers at application security company Socket, starting September…...

1+ week, 4+ day ago   (521+ words) Two actions-cool GitHub Actions have been disabled for a second time after the repositories became accessible last week, months after they were compromised during the May 2026 Mini Shai-Hulud campaign. The affected GitHub Actions are listed below - "On September 16, 2026, both repositories…...

1+ week, 6+ day ago   (150+ words) This is the final notification that Node 20 is no longer available on GitHub Actions runners. Runners now use Node 24 for JavaScript actions. The temporary ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out is no longer available. If you maintain a JavaScript action, update its runs.using value…...

2+ week, 10+ hour ago   (212+ words) Jenkins, an open-source automation server, has been the de facto standard for CI/CD for over a decade. Born from the Hudson project, Jenkins has cultivated a massive community and an unparalleled ecosystem of plugins, making it incredibly versatile and…...

2+ week, 13+ hour ago   (655+ words) A newly uncovered software supply chain attack has shown how quickly a trusted developer account can become a delivery route for malware. The operation, tracked as GHAPPIER, reached 65 GitHub repositories, infecting 73 files across 22 accounts. It involved a legitimate npm package…...