October 26, 2026
Give alert triage its own token permissions
A dedicated GitHub Actions workflow can read Dependabot alerts without inheriting the broader permissions used to build, publish, or deploy software.
Read article
Posts tagged “github-actions”.
One tag at a time. The full list is on the articles page.
October 26, 2026
Treat workflow changes as governed releases
I explain how to inventory workflow changes across repositories, require trusted review, and keep credentials out of untrusted workflow runs.
Read article
October 26, 2026
Give workflows an access model before secrets get finer-grained
A purpose-based access model helps teams reduce GitHub Actions secret exposure now and adopt finer-grained controls without confusing configuration for policy.
Read article
October 19, 2026
Plan GitHub Actions investigations around evidence
I explain how to define the evidence, retention and access an incident investigation needs before relying on GitHub Actions Data Stream.
Read article
October 19, 2026
A runner-image SBOM is not build provenance
A runner-image SBOM inventories preinstalled software, while build provenance connects an artifact to the workflow, actions, and inputs that produced it.
Read article
October 19, 2026
Treat repository-relative workflow references as a versioning choice
A repository-relative GitHub Actions reference ties a reusable workflow to the caller's version, trading centralized upgrades for co-versioned changes.
Read article
October 13, 2026
Treat GitHub Actions cache reuse as a trust boundary
A cache can expose data to readers or let an untrusted workflow influence a trusted build, so I make cache access part of pipeline security design.
Read article
October 13, 2026
CI egress policy should follow workflow trust
Runner identity is not enough to decide what a CI job may contact; I explain how to map dependencies and separate policy by job purpose.
Read article
October 13, 2026
Deeper workflow nesting needs a legible call graph
Deeper reusable workflows make shared CI/CD more flexible, but clear ownership, inputs, permissions, and deployment paths are what keep changes reviewable.
Read article
October 13, 2026
Execution policy belongs outside the workflow
GitHub Actions execution protections can block disallowed runs before workflow code starts, but they cannot make trusted workflow code safe.
Read article
October 13, 2026
A workflow security incident needs a recovery design
A recovery-ready CI architecture maps compromised actions to repositories and credentials, then restores safe shipping without reopening the same blast radius.
Read article
October 8, 2026
Treat custom runner images as build dependencies
I argue for versioning custom GitHub Actions runner images as shared build dependencies, with clear ownership for patching, validation and rollout.
Read article
October 6, 2026
A GitHub Actions lockfile needs an update policy
A lockfile can make workflow dependencies easier to audit, but shared pipelines still need owners, cross-repository tests, and an urgent-fix path.
Read article
October 2, 2026
Make secret access explicit in reusable workflows
Learn how scoped secrets could change reusable workflow contracts, and how to roll out explicit access and verify it with execution telemetry.
Read article