Topic
Everything filed under github-actions, across every section.
Use GitHub Actions artifacts for short-lived CI evidence and job-to-job handoffs, then publish only scanned, approved distributables as GitHub Release assets. This worked pipeline shows where the boundary belongs, how retention changes the decision, and how to enforce it.
A practical before-and-after migration for GitHub Actions artifact workflows. Learn how v4 changes artifact compatibility, availability, and download directories—and add checks that catch broken deploy paths before production.
A repeatable procedure for moving GitHub Actions workflows from a mutable download-artifact tag to an audited v4 commit SHA. Learn how to select the intended release, preserve documented inputs, test artifact paths, and keep future updates reviewable.
Audit GitHub Actions workflows before a dependency compromise forces rushed decisions. This repeatable method maps third-party actions, package installs, secrets, artifact handoffs, and blast radius into a remediation queue.
Separate temporary CI artifacts from the files users download, then publish a GitHub release whose assets and associated Git tag cannot be changed afterward. This checklist covers build promotion, checksums, release workflows, and the operational tradeoffs of immutability.
Harden a repository-level GitHub Actions pipeline with immutable action references, least-privilege tokens, environment-gated deployments, artifact checksums, and audit-friendly logs. Includes a practical workflow you can adapt for Node.js projects.
Turn GitHub Actions security guidance into a time-boxed repository audit. Find mutable action references, overpowered tokens, risky triggers, and third-party dependencies, then prioritize fixes by blast radius and effort.
Build CI/CD security around the pipeline controls that matter: source, dependencies, secrets, workflow behavior, artifacts, and deployment. Compare practical tools for each control and choose a lean GitHub Actions stack for a small project or a growing engineering organization.
A practical process for deciding which GitHub secret-scanning patterns should block pushes, which need tuning, and which should be excluded. Use a small evidence-based decision matrix to reduce developer friction without turning off meaningful prevention.
Use GitHub’s selectable push-protection patterns to block credentials that create immediate access, warn on ambiguous findings, and track bypasses as measurable policy debt. Includes a pilot plan, a tiering matrix, and exception metrics.