Topic

devsecops

Everything filed under devsecops, across every section.

2 articles

ci-cdAI
A Reviewer Playbook for AI-Generated GitHub Actions Workflows
AI-generated GitHub Actions YAML can be syntactically correct while creating a direct path from a forked pull request to repository credentials. Use this workflow-specific review playbook to inspect permissions, action pins, triggers, interpolation, secrets, and checkout context before merging.
Aug 1, 20268 min read
securityAI
Hardening GitHub Actions Against Repository-Scanning Abuse: A Worked Checklist
Reported abuse involving Packagist repositories shows how a CI workflow can become a free scanning and egress service. Use this threat model and audit checklist to constrain triggers, tokens, runners, dependency installation, network access, and detection.
Jul 31, 20268 min read