Signal
10 articles covering "ci-cd"
Socket found that actions-cool/issues-helper and actions-cool/maintain-one-comment, disabled since May 2026, became reachable again on September 16 with their malicious tags intact, silently re-running the payload.
The Rust Security Response Team disclosed and patched a Miri flaw that stored all environment variables in target/, letting cached CI output expose secrets to pull requests.
CNCF graduated Cloud Native Buildpacks on August 11, formalizing a build model that shifts base-image patching from Dockerfiles to a centralized builder.
A GitHub Actions failure on August 6 knocked out workflows, Pages, and Copilot for over eight hours, extending a run of dozens of monthly incidents this year.
Jenkins fixed CVE-2026-53435, an 8.8-rated deserialization flaw letting an attacker-controlled config.xml impersonate users and reach the Script Console for code execution on the controller.
GitHub is embedding permanent owner and repository IDs into Actions OIDC subject claims, with the new format becoming the default for repos created after July 15, 2026.
GitHub Code Quality added code coverage metrics to pull requests on May 26, completing a roadmap item announced at the feature's October 2025 launch.
GitHub released the Enterprise Server 3.21 release candidate on May 13, making organization custom properties generally available along with Projects hierarchy views, REST API 2026-03-10, and secret scanning and Actions workflow improvements.
GitHub moved custom runner images out of preview on March 26, exposing a snapshot keyword that turns a workflow run into a versioned VM image — and Copilot's own cloud agent cut another 20 percent off its cold start using it.
GitLab's April release adds a CI Expert Agent that generates pipelines from repository analysis, moves Agentic SAST vulnerability resolution to GA, and delivers natural-language DevOps analytics.