Topic
Everything filed under repository-security, across every section.
Replace retired GitHub protected-tag rules without accidentally allowing release tags to be moved, deleted, or recreated. This walkthrough maps common legacy policies to tag-targeting rulesets, fnmatch patterns, bypass choices, and practical verification steps.
GitHub’s legacy tag protection sunset is not just a settings migration. Use this practical checklist to inventory release tags, verify migrated tag rulesets, test controls in a low-risk repository, and assign long-term ownership.
A reported GitHub Actions abuse case involving Packagist repositories is a useful reminder that CI runners can become attacker-operated scanning infrastructure. Use this practical checklist to reduce untrusted trigger, token, network, action supply-chain, and monitoring risk.