Reference same-repository actions with self-repository syntax - GitHub Changelog
Reference same-repository actions with self-repository syntax You can now reference an action or reusable workflow that lives in the same repository using the new self-repository syntax. A uses: value that starts with $/ resolves to your workflow’s own repository at the exact commit that is running, with no checkout required. It works everywhere the workspace-relative ./ syntax works, including wo
More control over your GitHub-hosted runners - GitHub Changelog
Menu. Currently selected: What you can do with macOS runners Organizations now have more control over who can use GitHub-hosted runners in Actions. Admins can now disable the standard labels for hosted runners such as ubuntu-latest, as well as add macOS runners to runner groups. What you can do with macOS runners Restrict access to macOS runners: Limit which organizations, repositories, or workflo
GitHub Actions: Early April 2026 updates - GitHub Changelog
Menu. Currently selected: Customizing entrypoints for service containers Editor’s note (April 20, 2026): We updated this post to clarify in preview, VNET failover manual and not automated This month, GitHub Actions adds entrypoint and command overrides for service containers and new security features including OIDC custom properties and VNET failover. Customizing entrypoints for service containers
Securing the open source supply chain across GitHub
AI & MLLearn about artificial intelligence and machine learning across the GitHub ecosystem and the wider industry. Generative AILearn how to build with generative AI. GitHub CopilotChange how you work with GitHub Copilot. LLMsEverything developers need to know about LLMs. Machine learningMachine learning tips, tricks, and best practices. How AI code generation worksExplore the capabilities and be
GitHub Actions Is Slowly Killing Your Engineering Team - Ian Duncan
I was an early employee at CircleCI. I have used, in anger, nearly every CI system that has ever existed. Jenkins, Travis, CircleCI, Semaphore, Drone, Concourse, Wercker (remember Wercker?), TeamCity, Bamboo, GitLab CI, CodeBuild, and probably a half dozen others I’ve mercifully forgotten. I have mass-tested these systems so that you don’t have to, and I have the scars to show for it, and I am her
Custom images for GitHub-hosted runners are now generally available - GitHub Changelog
Custom images for GitHub-hosted runners are now generally available Custom images for GitHub-hosted runners are now generally available. Originally introduced in public preview in October 2025, this feature lets you start with a GitHub-curated base image and build your own virtual machine image tailored to your workflow needs. By defining your runner environment up front with preinstalled tools, d
GitHub Actions: Late March 2026 updates - GitHub Changelog
Menu. Currently selected: GitHub Actions now allows developers to use environments without auto-deployment This month, GitHub Actions resolves some outstanding papercuts, including support for timezones in scheduled workflows and using environments without automatic deployments. GitHub Actions now allows developers to use environments without auto-deployment GitHub Actions now supports using envir
hackerbot-claw: An AI-Powered Bot Actively Exploiting GitHub Actions - Microsoft, DataDog, and CNCF Projects Hit So Far - StepSecurity
A week-long automated attack campaign targeted CI/CD pipelines across major open source repositories, achieving remote code execution in at least 4 out of 7 targets. The attacker, an autonomous bot called hackerbot-claw, used 5 different exploitation techniques and successfully exfiltrated a GitHub token with write permissions from one of the most popular repositories on GitHub. We're entering an
Home | GitHub Agentic Workflows
Repository automation, running the coding agents you know and love, with strong guardrails in GitHub Actions. Imagine a world where improvements to your repositories are automatically delivered each morning, ready for you to review. Issues are automatically triaged, CI failures analyzed, documentation maintained and tests improved. All defined via simple markdown files. GitHub Agentic Workflows de
GitHub Actions のシークレットは簡単に見れる
はじめに こんにちは。エン株式会社のプラットフォームグループ（PFG）に所属している山﨑です。私が所属しているチームでは週１回輪読会を行っており、GitHub Actions の本を読んでいます。「GitHub CI/CD実践ガイド」という本で、めちゃくちゃオススメです。この記事の内容の多くは本の中で紹介されているので、気になった方は読んでみてください。 GitHub Actions を使えば CI/CD を簡単に構築できますが、セキュリティの観点で注意しないといけないことが多くあります。セキュリティより利便性が重視されている傾向にあるため、どこにどんなリスクがあるのか把握しておくことは重要です。今回はその一つとしてシークレットを取り上げます。 この記事の目的 この記事では、GitHub Actions のセキュリティリスクの一つとして、シークレットが簡単に露出してしまう仕様について解説し
Pricing changes for GitHub Actions
TLDR: We’re postponing the announced billing change for self-hosted GitHub Actions to take time to re-evaluate our approach. We are continuing to reduce hosted-runners prices by up to 39% on January 1, 2026. We’ve read your posts and heard your feedback. We’re postponing the announced billing change for self-hosted GitHub Actions to take time to re-evaluate our approach. We are continuing to reduc
The GitHub Actions control plane is no longer free | Blacksmith
GitHub is adding a $0.002-per-minute fee on all GitHub Actions usage, so the control plane is no longer free. What's happening?GitHub just announced changes to Actions pricing. Previously, GitHub Actions had a free control plane. That meant if you used GitHub Actions but ran jobs outside of GitHub-hosted runners, whether that’s on Blacksmith, on your own machines, or in your own AWS account, you p
LT_コンテキスト活用術.pdf
How People are Using Generative and Agentic AI to Supercharge Their Products, Projects, Services and Value Streams Today
GitHubでサプライチェーン攻撃を防ぐ設定 - Plan 9とGo言語のブログ
ここ数ヶ月でサプライチェーン攻撃に関連していくつかベストプラクティスが出ていたので、GitHubのリポジトリに適用しておいたほうがいいものをまとめた。 被害を受けないために Dependabotにcooldownを設定する 過去のサプライチェーン攻撃では、ほとんどは問題のあるリリースが公開されてから数時間で発見されているので、自分のリポジトリが汚染されないためにリリースから一定期間はアップデートを保留するという手段が取られるようになったと記憶している。もともとRenovateには minimumReleaseAge オプションがあったのだが、Dependabotでも cooldown オプションが使えるので設定する。 Dependabot supports configuration of a minimum package age このオプションを設定しても、上の記事中に Key ben
GitHub Actions で YAML アンカーを使う
GitHub Actions のワークフローで YAML アンカーがサポートされました。YAML アンカーを使用すると、ワークフロー内でコードの重複を避け、共通の設定を再利用できます YAML アンカーは、YAML ドキュメント内で特定のノードに &anchor_name を使用して名前を付け、そのノードを *anchor_name を使用して参照することで機能します。例えば以下に例では、on.push セクションをアンカーとして定義し、on.pull_request セクションで再利用しています。 on: push: branches: &branch_list - main pull_request: branches: *branch_list
リリース、障害情報などのサービスのお知らせ
最新の人気エントリーの配信
j次のブックマーク
k前のブックマーク
lあとで読む
eコメント一覧を開く
oページを開く
bun/.claude/workflows/lifetime-classify.workflow.js at 23427dbc12fdcff30c23a96a3d6a66d62fdc091d · oven-sh/bun
「お金で解決」が全てではない！大規模WebアプリのCI高速化 #phperkaigi
- YouTube
Container Caching (Beta) - Blacksmith
Ubicloud - GitHub Actions, 7x Price-Performance
