October 19, 2026
A runner-image SBOM is not build provenance
A runner-image SBOM inventories preinstalled software, while build provenance connects an artifact to the workflow, actions, and inputs that produced it.
Read article
Posts tagged “software-supply-chain”.
One tag at a time. The full list is on the articles page.
October 8, 2026
Treat custom runner images as build dependencies
I argue for versioning custom GitHub Actions runner images as shared build dependencies, with clear ownership for patching, validation and rollout.
Read article
October 6, 2026
A GitHub Actions lockfile needs an update policy
A lockfile can make workflow dependencies easier to audit, but shared pipelines still need owners, cross-repository tests, and an urgent-fix path.
Read article