Tag
A security research reveals a technique named Megalodon for mass backdooring of GitHub repositories by exploiting CI workflows.
The npm account 'atool' was compromised, leading to the publication of 637 malicious versions across 317 packages. The payload harvests credentials, establishes persistence via AI coding tools and system services, and exfiltrates data through GitHub.
The article argues that AI coding agent failures stem from poor system design rather than model limitations, outlining a three-layer 'harness' of knowledge, guardrails, and feedback loops to reliably ship production code.
Warp, an AI-powered terminal startup, has publicly released its production-ready 'oz-skills', featuring 15 automated Agent Skills for tasks like CI failure auto-fixing, GitHub issue triage, and SEO audits.
GitHub improved token efficiency in their agentic workflows by logging token usage via an API proxy and building daily optimization workflows, reducing overhead from unused MCP tool registrations.
A developer shares their GitHub Actions setup for testing a Gleam monorepo with separate BEAM and JavaScript runtimes, using matrix strategies and strict formatting checks.
Critical command injection vulnerabilities (CVE-2026-35022, CVSS 9.8) discovered in Anthropic's Claude Code CLI and SDK allow attackers to execute arbitrary commands and steal credentials through environment variables, file paths, and authentication helpers. The flaws enable poisoned pipeline execution attacks in CI/CD environments, requiring immediate patching and configuration changes.
Rakuten has integrated OpenAI's Codex coding agent into its engineering workflows, achieving approximately 50% reduction in mean time to recovery (MTTR) and automating CI/CD code review and vulnerability checks. The company reports compressing quarter-long development efforts into weeks through agentic, autonomous execution.
Jenkins is a leading open-source automation server built with Java, used for CI/CD, testing, deployment, and automating development workflows.
Openship is an open-source, self-hostable deployment platform with built-in CI/CD, supporting any stack, databases, domains, SSL, and more, accessible via desktop app, web dashboard, or CLI.
A GitHub Action for checking out a repository, enabling workflows to access code.