Topic
Security of build and automation pipelines, including workflow triggers, runner access and secrets exposed to automation jobs.
SHA pinning drew a clean line through the tj-actions compromise, and then Dependabot began bumping hashes faster than anyone could read them. The claim worth enforcing is the version comment that nothing verifies.
Reality
A cybersecurity undergraduate's taint scanner for GitHub Actions returned 61 medium-severity findings across 67 repositories. Of those, 59 came from one rule he then found was wrong about how the platform works.
Reality
The new cloud web applications threat matrix sorts eleven ATT&CK tactics for managed runtimes and serverless code, starting with assets an app team rarely owns, such as dead DNS records and linked source repositories.
Reality
Build configurations can now authenticate to AWS and Google Cloud without stored keys, provided you accept that the TeamCity server holds the signing key and that rotating it leaves already-issued tokens valid.
Reality
JetBrains says CVE-2026-63077 lets an unauthenticated attacker run arbitrary commands on a TeamCity server. The rotation list it handed Cadence users doubles as the recovery scope for anyone self-hosting.
Reality
For anyone running pull_request_target, pinning v7 starts with a workflow audit rather than a version bump, and the credential relocation underneath it carries a runner version floor that self-hosted fleets should check first.
Reality
field-cage blocks outbound connections from Linux runners in the kernel, keeps its logs on the box, and disclaims step correlation, tamper detection and organization-wide visibility.
Reality
GitHub's August release retunes Actions queries for cache poisoning, output clobbering and untrusted checkouts. Most of the work went into cutting false positives, not adding coverage.
Reality