CI/CD news and engineering summaries

GitHub Actions experienced a major outage from August 6–7, 2026, causing workflow failures, extended queues, and webhook delays for GitHub-hosted and self-hosted runners. A routine deployment exposed capacity and concurrency weaknesses, while a job-assignment bug caused runners to retry invalid jobs. GitHub restored service by expanding capacity, draining queues, deploying fixes, and improving safeguards and automatic recovery.

Attackers hijacked an axios maintainer's npm account to publish malicious versions (1.14.1, 0.30.4) that install a hidden dependency, plain-crypto-js. This payload executes a cross-platform RAT dropper, contacts a C2 server, and self-cleans to evade detection. Compromised users are urged to rotate credentials immediately and downgrade to secure versions (1.14.0 or 0.30.3).

GitHub has launched public preview support for Stacked Pull Requests. This feature allows developers to break large tasks into smaller, dependency-ordered pull requests. Teams can review individual layers in parallel, improve code quality, and merge entire stacks in one operation, significantly reducing friction in complex software development workflows.

On May 11, 2026, TanStack suffered a supply chain attack where 84 malicious package versions were published. Attackers chained GitHub Actions cache poisoning, pull_request_target misuse, and OIDC token theft to bypass CI/CD security. No npm credentials were stolen, but local installations may be compromised. All affected versions were deprecated, and security hardening is underway.

A security researcher reversed Hanwha Vision camera firmware, uncovering outdated obfuscation techniques and finding a hardcoded GitHub token. The token, exposed due to poor CI/CD practices, had broad administrative access. Additionally, the discovery of U.S. Department of Defense IP addresses in the firmware environment variables prompted questions about corporate infrastructure integration.

Filippo Valsorda argues against using Dependabot due to excessive false positives, particularly in the Go ecosystem. He recommends replacing it with govulncheck and scheduled GitHub Actions. This approach utilizes reachability analysis to filter irrelevant security alerts and suggests testing against latest dependencies in CI without immediate, noisy version bumps.

GitHub Actions experienced degraded availability on August 26, 2026, caused by an issue with a database primary and upstream Vitess systems. Failover, traffic throttling, and a gradual ramp-up restored service. Delays affected some jobs, with 3.7% of larger-runner jobs canceled. Pages recovered, and monitoring continued; a detailed root cause analysis is pending.

A coordinated supply chain attack compromised over 170 npm packages and 2 PyPI packages, totaling 404 malicious versions. Notable targets included TanStack, Mistral AI, UiPath, and OpenSearch. The malware exfiltrates cloud and CI/CD credentials via the Session protocol and uses IDE-poisoning techniques to ensure self-propagation through malicious commits, marking a major escalation in cross-ecosystem registry poisoning.

Migrating repositories from GitHub to Codeberg is simplified by built-in import tools and the familiarity of Forgejo Actions. Users can replicate GitHub workflows, use codeberg.page for hosting, and handle CI transitions by self-hosting runners. The process involves archiving old repositories and managing mirrors to maintain a smooth transition for existing contributors.

The author, a veteran of numerous CI systems, argues that GitHub Actions creates significant operational friction for engineering teams. Issues include a slow, unstable log viewer, complex and limiting YAML syntax, opaque marketplace dependencies, and inadequate compute control. The author recommends Buildkite for its superior logs, better compute ownership, and cleaner pipeline architecture.

GitHub is currently experiencing a major service disruption affecting GitHub Actions, Copilot features, and GitHub Enterprise Importer. Issues include failing or delayed workflow runs, time-outs, and API errors. Engineering teams have implemented initial mitigations and are actively deploying further fixes to restore full system stability and recovery across all services.

Obsidian has launched a new Community portal and developer dashboard to streamline plugin and theme management. The initiative introduces automated security and code quality reviews, real-time status tracking, and project scorecards. These updates aim to improve ecosystem safety and scalability while enabling faster submission processes and enhanced discovery tools for the platform's 120 million-plus downloads.

A developer blamed a Cursor/Claude agent for deleting their production database, highlighting a lack of accountability. The author argues that human error and poor architecture—specifically exposing dangerous API endpoints—are the root causes. True security requires robust automated processes and human oversight rather than blindly relying on AI to perform critical tasks.

In this article, the author expresses a profound frustration with GitHub Actions, detailing an experience with a broken feedback loop during a project build. While developing a tool called tmplr, the author encountered persistent failures on a Linux ARM runner that were difficult to debug locally. The narrative highlights the inefficiency of the 'edit-push-wait' cycle, which often takes several minutes for a single YAML change, comparing it to the slow era of loading programs from cassette tapes. To resolve the issue, the author advocate for keeping CI logic within local scripts or Makefiles rather than embedding it directly into the GitHub Actions configuration. Despite the disdain for the platform's debugging process, the author acknowledges its necessity for providing environments like macOS runners that are otherwise hard to access, concluding that developers are essentially 'doomed' to use it.

Astral details its rigorous security strategy for open-source tools like Ruff and uv. The approach focuses on hardening GitHub Actions via hash-pinning, permission reduction, and trigger restrictions, while leveraging Trusted Publishing, Sigstore attestations, and dependency management to secure the software supply chain. Their model promotes isolation, multi-party approvals, and proactive risk mitigation.

Local-first CI advocates for running build and test scripts locally before pushing to remote servers like GitHub Actions. This approach shortens feedback loops, minimizes context switching, and ensures reproducibility. By using tools like Nix to synchronize environments, developers can catch errors faster and avoid vendor lock-in associated with platform-specific CI configurations.

On March 31, 2026, compromised versions of axios (1.14.1 and 0.30.4) were published to npm via a hijacked maintainer account. The attacker injected a malicious dependency, plain-crypto-js, which executes an obfuscated postinstall payload. This script downloads platform-specific RATs for Windows, macOS, and Linux, bypassing standard CI/CD and SLSA provenance checks. Users should pin axios to safe versions and rotate credentials.

The article explores the fundamental purpose of Continuous Integration (CI), arguing that its primary value lies in its failure rather than its success. When CI passes, it provides no functional difference compared to a deployment without CI; however, when it fails, it acts as a critical safety net that catches mistakes before they reach production. By shortening the feedback loop and providing automated checks, CI prevents the costly manual rollbacks required when errors are discovered by users. The author also addresses the problem of flaky tests, which undermine this value by making failures unreliable indicators of bug presence. Ultimately, the piece proposes reframing CI 'failures' as positive, valuable outcomes while distinguishing them from technical flakiness.

Open source registries like Maven Central are planning a tiered payment system to address the 'tragedy of the commons.' With 82% of downloads coming from 1% of IPs, massive corporations are abusing repositories as free CDNs. The new model aims to charge high-volume commercial users while keeping access free for individual developers and small projects.

A startup testing Blacksmith, a GitHub Actions alternative, discovered they were invoiced over $1,000 for usage exceeding their free trial. Unlike standard SaaS models that implement hard usage caps, Blacksmith continued service, creating unexpected debt. While the billing policy was surprising, the company opted to remain with Blacksmith due to superior performance compared to GitHub Actions.