Because GitHub Actions are fetched from Git, the previous advice was to pin to a full SHA instead of a tag. This is because tags are mutable and susceptible to supply-chain attacks where an attacker points a previously safe tag at malicious code.
GitHub lock-in?
There has been a lot of noise recently on how GitHub is bad, and how developers should stop using it.
Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles | Wiz Blog
An automated campaign is planting secret-dumping workflows in every repository that stolen GitHub tokens can reach. It uses no C2 server, is actively evolving, and has been significantly disrupted by recent GitHub security improvements.
Agent CI — Run GitHub Actions Locally
Caching in ~0 ms. Pause on failure. Let your AI agent fix it and retry — without pushing.
Under the hood: Security architecture of GitHub Agentic Workflows
Learn how our threat model and security architecture help teams run agents safely in GitHub Actions.
Why GitHub Actually Won
How GitHub _actually_ became the dominant force it is today, from one of it's cofounders.
Generating a new GPG key - GitHub Docs
If you don't have an existing GPG key, you can generate a new GPG key to use for signing commits and tags.
GPG signature verification
When you’re building software with people from around the world, sometimes it’s important to validate that commits and tags are coming from an identified source. Git supports signing commits and…
Investigating unauthorized access to GitHub-owned repositories
If any impact is discovered, customers will be notified via established incident response and notification channels.
GitHub Actionsのworkflow lockfileがGA。更新漏れとオンボードし忘れを、CI・Dependabot・ポリシーでどう止めるか試す | DevelopersIO
GitHub Actionsのworkflow lockfileがGAになりました。更新漏れとオンボードし忘れを、CIの--verify、Dependabot、Require lockfileでどこで止められるかを試し、Freeプランでの代わりの手段まで整理します。
Ditching GitHub
This is going to be some sort of a public service announcement, withside notes. This has been brewing for a long, long time (years), it’sjust that I never se...
Kindly Closing Pull Requests
Getting your first pull request from an outside contributor on GitHub is an exciting experience. Someone cared enough about the problem you were solving to check it out themselves, change…
GitHub Codespaces
GitHub Codespaces gets you up and coding faster with fully configured, secure cloud development environments native to GitHub.
GitHub MCP Exploited: Accessing private repositories via MCP
We showcase a critical vulnerability with the official GitHub MCP server, allowing attackers to access private repository data. The vulnerability is among the first discovered by Invariant's security analyzer for detecting toxic agent flows.
