Lightnews — Scholar-powered news

Nx の攻撃から学べること #s1ngularity | blog.jxck.io

sawachyon.bsky.social

@sawachyon.bsky.social

AIで作ったコードを取り込み、GithubActionでのスクリプトインジェクション、npmのトークン窃盗、汚染されたパッケージのpublish、インストールした環境の秘密情報を窃盗という流れ。ローカルも安全はないので、1passwordなどで環境ファイルを保護するなどが必要。

Nx リポジトリが攻撃を受け、広範囲にわたるインシデントが発生した。今回の事例は、GitHub Actions を中心に複数のステップが組み合わさった攻撃であり、過去に何度も発生してきた攻撃と本質的には変わらない。しかし、途中で AI が何度か登場するため「AI が書いたコ...

blog.jxck.io

September 4, 2025 at 10:58 AM Everybody can reply

Shoper Gamer

@shopergamer.bsky.social

Google ปรับปรุง Gemini CLI ให้ทำงานอัตโนมัติใน GitHub Actions ได้

#ShoperGamer #Google #Gemini #GeminiCLI #Ai #Code #GithubAction #Feed

[Shoper Gamer] Google ปรับปรุง Gemini CLI ให้ทำงานอัตโนมัติใน GitHub Actions ได้ โดย

โดย

www.blockdit.com

August 8, 2025 at 6:05 AM Everybody can reply

1 reposts 2 likes

1 2

Shoper Gamer

@shopergamer.bsky.social

ข้อจำกัดสำคัญของ GitHub Actions สำหรับบัญชีฟรีที่คุณต้องรู้

อ่านต่อ : www.blockdit.com/posts/683bf3...

#ShoperGamer #Github #Account #Deploy #Cl/CD #GithubAction #FreeAccount #Knowledge #Study #Feed

June 1, 2025 at 7:21 AM Everybody can reply

2 likes

GitHub - StartAutomating/PSSVG: Script SVGs with PowerShell

James Brundage | MVP

@mrpowershell.com

Script #SVG with #PowerShell

I use this to make almost every logo for my projects in #GitHub #workflows

It also has a #GitHubAction

Have fun!

github.com/StartAutomat...

Script SVGs with PowerShell. Contribute to StartAutomating/PSSVG development by creating an account on GitHub.

May 30, 2025 at 6:55 PM Everybody can reply

1 reposts 1 quotes 3 likes

1 3

えるたん

@l-tan.dolciss.net

なんかGitHubAction失敗メールがくるなと思ったらぎっはぶーーーーー
www.githubstatus.com

Screenshot of GitHub Status

We're experiencing errorsSubscribe
Update - We are continuing to investigate degraded performance.
May 26, 2025 - 07:53 UTC
Update - Issues is experiencing degraded performance. We are continuing to investigate.
May 26, 2025 - 07:35 UTC
Investigating - We are investigating reports of degraded performance for API Requests and Git Operations
May 26, 2025 - 07:21 UTC

May 26, 2025 at 8:13 AM Everybody can reply

2 likes

Comparison of GitHub Action Scanners

Andreas Wittig

@andreaswittig.bsky.social

🙀 Oh, this is an unexpected limitation of GitHub Actions:

When pushing more than 3 tags at once, GitHub Actions does not trigger any workflows.

#github #githubaction

May 23, 2025 at 7:21 AM Everybody can reply

Fabian Kammel

@datosh18.bsky.social

I saw a lot of talk about #GitHubAction Static Code Analyzers in the wake of some high profile supply chain attacks. Primarily #poutine and #zizmor, but I also came across #octoscan and a research project by #Snyk. Here is my comparison of the four:

blog.kammel.dev/post/github_...

A comparison of GitHub Action Scanners.

blog.kammel.dev

May 17, 2025 at 11:16 AM Everybody can reply

1 likes

Release v2.0.0 · impresscms-dev/strip-markdown-extensions-from-links-action

Michael Ayres

@random-coder-1.bsky.social

My @github.com action workflow is just building. Can I override the icon and text here? It's confusing when people see the word "deploy" and it wasn't deployed at all. Executed? Run/Ran?

A conditional change would be great. I do have a deploy step that only happens on some branches

#GithubAction

screenshot of github workflow being executed on a PR. It shows a rocketship launching and has the text "This branch was successfully deployed" along with a subheading of "1 active deployment"

May 2, 2025 at 8:47 PM Everybody can reply

David Rach

@davidrach.bsky.social

Hey #Quarto #RStats friends, my Quarto website when rendered on my local computer correctly places the plotly widgets into rows and columns (creating a site_lib/quarto-dashboard folder with .js files in the process). However, when I set up a #githubaction it gets rendered single column🙃 Any ideas?

May 1, 2025 at 12:52 AM Everybody can reply

1 likes

2 1

Delgado Guy

@pyrometheous.bsky.social

I also setup a #GitHubAction to automatically publish my pushes to PyPI 😁

April 19, 2025 at 12:24 AM Everybody can reply

Raimondas Rimkevičius

@mekdrop.bsky.social

Finally, after a lot of delayed moments, I managed to fix some old issues! It wasn't difficult - just finding time for open-source work is the hard part... especially when you have more than one project to juggle... anyways, github.com/impresscms-d... #GitHubAction #OpenSource #NewRelease

This release replaces the old transform-markdown-links parser with remark for better context-aware link detection, switches from TypeScript to JavaScript for simpler maintenance, and adds a new ign...

April 18, 2025 at 8:59 PM Everybody can reply

1 likes

Cees-Jan Kiewiet

@wyrihaxim.us

Ah, the fun of hosting your own #GitHubAction runners for your projects <3.

April 14, 2025 at 7:55 PM Everybody can reply

2 likes

Release v6.0.0 · boly38/action-umami-report

Boly38

@boly38.bsky.social

action-umami-report v6.0.0 is out !

add a daily and/or a weekly GitHubAction cron
=> fetch your website analytics
=> from hosted or cloud Umami server,
=> send them to Discord (or elsewhere)

that's free :)
github.com/boly38/actio...

#umami #github #githubactions #workflow #analytics

[closed] generalize workflow config #70 #94 [closed] fix GHA warns #93 [closed] fix no view no report conditions #92 [closed] no view no report, minor report format upd, fix pageViews #91 [closed] ...

GitHub - gbraad-actions/codium-server-action: Run a remote web extension host based on VS Codium

April 9, 2025 at 12:18 PM Everybody can reply

Gerard Braad

@gbraad.nl.web.brid.gy

Also created a #github Action to deploy #VSCodium Server for debugging when a failure occurs.

https://github.com/gbraad-actions/codium-server-action

I use this myself with #Tailscale to check what actually happened on a runner.

#GitHubAction

Run a remote web extension host based on VS Codium - gbraad-actions/codium-server-action

Announcing TestInfra Action

April 7, 2025 at 12:35 AM Everybody can reply

Cees-Jan Kiewiet

@wyrihaxim.us

Announcing my TestInfra GitHub Action: blog.wyrihaximus.net/2025/03/anno...

#python #testInfra #GitHub #GitHubAction #OCI #Docker

One of the key parts of Building Secure Images with GitHub Actions is unit testing the image just build. While for most of my repositories this has been some bash script in the repo that I copied to…

blog.wyrihaximus.net

March 31, 2025 at 8:30 PM Everybody can reply

matricedigitale.bsky.social

@matricedigitale.bsky.social

Gravi minacce su GitHub: una GitHub Action compromessa espone segreti CI/CD e una campagna di phishing prende di mira 12.000 repository.

#CI/CDsecurity #cybersecurity #github #GitHubAction #malware #OAuthattack #PHISHING #supplychainattack
www.matricedigitale.it/sicurezza-in...

March 17, 2025 at 3:12 PM Everybody can reply

matricedigitale.bsky.social

@matricedigitale.bsky.social

Gravi minacce su GitHub: una GitHub Action compromessa espone segreti CI/CD e una campagna di phishing prende di mira 12.000 repository.

#CI/CDsecurity #cybersecurity #github #GitHubAction #malware #OAuthattack #PHISHING #supplychainattack
www.matricedigitale.it/sicurezza-in...

March 17, 2025 at 3:12 PM Everybody can reply

Arda Kılıçdağı

@arda.bsky.social

⚠️ Tj-actions/changed-files GitHub Action Compromised

www.stepsecurity.io/blog/harden-...

#github #githubaction

Harden-Runner detection: tj-actions/changed-files action is compromised - StepSecurity

tj-actions/changed-files

www.stepsecurity.io

March 15, 2025 at 6:41 PM Everybody can reply

1 likes

Lewis Westbury 💛💙🌱

@instantiator.bsky.social

Not gonna lie, I'm pretty pleased with progress! #Presence is an #OSS tool to format and post threads to any* social network - as a #CLI, #.NET #library, or #GitHubAction...

✅ BlueSky
✅ Threads
✅ Links
✅ Hashtags
✅ Images (+ alt text)

🔜 Mentions...
🔜 More networks...

🔖 instantiator.dev/presence

February 9, 2025 at 4:04 PM Everybody can reply

2 likes

1 2

nove-b🦥

@nove-b.social.nove-b.dev.ap.brid.gy

Node.jsとGithubActionでやろうと思ってたけど、Railsでやれば良いんじゃ🤔？

February 1, 2025 at 3:49 AM Everybody can reply

GolangOSS

@golangoss.bsky.social

Setup-Go2004-GitHubAction (⭐️ 3)

A GitHub action for the Go! programming language (by Francis McCabe, 2004)

#go

January 6, 2025 at 4:39 AM Everybody can reply

yannsay.bsky.social

@yannsay.bsky.social

I was looking for a way to publish my code on GitHub my repository and at the same time render the page on the GitHub Page at each commit. The solution I found was to use this GitHub Actions.
Is there a better way? I’d love to hear your thoughts!
#Rstats #Quarto #GithubAction

December 3, 2024 at 4:23 PM Everybody can reply

Comment construire une image Docker avec des variables d'environnement dans une GitHub action ?

Thomas

@tvn.dev

Ça fait un moment que je devais le faire, me voici enfin lancé. J’ai écrit et publié mon premier article en français et anglais sur un problème que j’ai rencontré lors du déploiement d’une application.
Hésitez pas à partager 🙏🏻.
thomasevano.fr/posts/commen...

#buildinpublic #docker #githubaction

thomasevano.fr

November 28, 2024 at 12:05 PM Everybody can reply

2 likes