#github-actions

3 articles tagged

Engineering · Aug 5, 2026 · 15 min read

CI secrets are readable from runner memory: the 2026 credential isolation architecture for GitHub Actions

Attackers force-pushed 75 of 76 trivy-action tags in March 2026 and stole secrets from every pipeline that ran a scan. Here is the credential isolation architecture that survives a poisoned action, with the exact GitHub

Manu Shukla

#github-actions #DevSecOps #ci-cd

GitHub Actions CI graphic showing the 25 September 2026 self-hosted runner enforcement cutoff

Engineering · Aug 4, 2026 · 14 min read

GitHub Actions runner enforcement: 24 August brownouts, 25 September cutoff

GitHub resumes minimum version enforcement for self-hosted runners on 25 September 2026, with brownouts from 24 August. How to inventory a fleet, fix each runner type, and avoid the 30-day trap.

Manu Shukla

#github-actions #ci-cd #DevOps

Sealed package with a glowing padlock moves along a conveyor past a cracked block leaking red light

Engineering · Jul 17, 2026 · 20 min read

84 malicious npm versions in 6 minutes: the 2026 TanStack trusted-publishing breach and the CI config that stops it

TanStack's release pipeline authenticated 84 malicious npm versions in six minutes using a valid OIDC token. No token was stolen. Here is the chain, and the controls that close it as of July 2026.

Manu Shukla

#npm #github-actions #supply chain security