Key PointsOn October 14, GitHub released a public preview of workflow dependency lockfiles for Actions. This mechanism allows ...

Spread the loveWhen you’re diving into the world of development, automation can save you a ton of time and headaches. GitHub ...

Menu. Currently selected: Keep locked dependencies up to date with Dependabot Keep locked dependencies up to date with Dependabot Get started GitHub Actions workflow dependency lockfiles are now in ...

Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious ...

When developing in a team, it is surprisingly tedious to keep track of "what was merged into main today." Since reading the ...

GitHub Actions, which allows you to automatically execute workflows triggered by GitHub events, on December 16, 2025. The core of this announcement is that the price of GitHub-hosted runners will be ...

GitHub disabled two actions-cool Actions again after re-enabled repositories left malicious May 18 tags able to execute credential-stealing code.

In yet another software supply chain attack, threat actors have compromised the popular GitHub Actions workflow, actions-cool/issues-helper, to run malicious code ...

Two GitHub Actions were re-enabled while Mini Shai-Hulud malicious code remained active, potentially exposing workflows and CI/CD secrets.