# github action Published articles for github action. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Scheduling Claude Code for Nightly Repository Maintenance DevFeed: [Scheduling Claude Code for Nightly Repository Maintenance]() Original publisher: [Read original article]() Author: Eric Roby Published: 2026-07-28T12:03:08Z Content type: tutorial Language: en Sources: [Eric Roby]() Topics: [Claude Code](), [Security](), [Refactoring](), [ci](), [hooks](), [Code]() Tags: [automated](), [ci](), [claude-code](), [github-action](), [hooks](), [how-to](), [refactor](), [repo](), [security]() ### AI overview The article explains how to schedule Claude Code in headless mode for recurring repository maintenance. It recommends focused jobs for security sweeps, refactoring scans, and enhancement reviews, using structured JSON output and the --bare option for consistent scripted runs. ### Source excerpt How to schedule headless runs for nightly security sweeps, refactor scans, and enhancement ideas ## Presentation on Building React Native Test Automation with Detox and TypeScript DevFeed: [Presentation on Building React Native Test Automation with Detox and TypeScript]() Original publisher: [Read original article]() Author: T.J. Maher (noreply@blogger.com) Published: 2026-06-30T00:51:55Z Content type: article Language: en Sources: [T.J. Maher]() Topics: [Mobile Testing](), [React](), [TypeScript](), [CI/CD](), [Mobile](), [GitHub Actions](), [Vibe coding]() Tags: [ci-cd](), [github-action](), [mobile](), [mobile-test-automation](), [mobile-testing](), [react-native](), [testing](), [typescript](), [vibe-coding]() ### AI overview The article promotes T.J. Maher's presentation for the Sydney Testers Meetup on building automated tests for React Native applications with Wix's open-source Detox framework and TypeScript. ### Source excerpt If I presentation to the Sydney Testers Meetup in Australia, from my home in the Massachusetts, through Zoom, does that make me an international speaker? [ Vote in the New Poll, on LinkedIn ] There is still time to sign up for the event at: https://www.meetup.com/sydney-testers/events/315166776 "T.J. Maher, the former organiser at Ministry of Testing Boston, blogger and speaker, will be presenting from the US on using the Detox framework to create effective test automation frameworks for React Native applications. "Building a React Mobile Automated Test Framework using Detox + TypeScript by T.J. Maher "Writing automated tests for a React Native mobile application is notoriously difficult. Mobile components display on the page, but are not fully loaded. Lengthy animations and slow-loading components take a while to finish. Timing issues cause your automated tests to error out giving the appearance of flaky tests. "T.J. Maher will be sharing his experience tackling these problems using the open-source mobile testing framework, Wix's Detox, designed specifically for testing React Native applications. * "Setting up a mobile test automation framework. * "Vibe-coding a toy React Mobile Login page app to test against ( tinyurl.com/detox-demo ). * "How to reduce timing issues and flakiness in automated tests. * "Refactoring code into tests, page objects & base pages, separating out credentials and message strings for easier maintainability. * "Setting up automated tests in CI / CD for iOS simulators and Android emulators with GitHub Action Workflows. * "How developers can test their code before they push it into the main branch. "About T. J. Maher: --------------------- "A former organizer of the now defunct Ministry of Testing - Boston, T.J. Maher is a Senior Software Development Engineer in Test (SDET), based in the Boston/South Shore area of Massachusetts, with a decade of experience building web + mobile test automation frameworks. His recent work includes architecting ## SQGNE Lecture is tonight! Building a React Native Mobile Automated Test Framework with T.J. Maher DevFeed: [SQGNE Lecture is tonight! Building a React Native Mobile Automated Test Framework with T.J. Maher]() Original publisher: [Read original article]() Author: T.J. Maher (noreply@blogger.com) Published: 2026-05-20T14:12:23Z Content type: article Language: en Sources: [T.J. Maher]() Topics: [Mobile Testing](), [React Native](), [Testing](), [CI/CD](), [TypeScript](), [GitHub Actions]() Tags: [ci-cd](), [github-action](), [mobile-testing](), [react-native](), [sqgne](), [test-automation](), [testing](), [typescript]() ### AI overview The article announces a Software Quality Group of New England lecture on building an automated testing framework for React Native mobile applications. It describes using Wix's Detox to address loading, animation, timing, and test flakiness issues, with examples covering refactoring, maintainability, and CI/CD testing on iOS simulators and Android emulators. ### Source excerpt Are you in Boston? Come hear me talk about Building a a React Native Mobile Automated Test Framework in tonight's Software Quality Group of New England meeting in Burlington, MA: Registration Page: https://sqgne.org/n-May-2026.html Slide Deck: https://tinyurl.com/detox-demo-sqgne Taken from the Registration page: "Building a React Native Mobile Automated Test Framework Thomas F. - T.J. - Maher, Jr. "Wednesday May 20, 2025 6:30-8:00 PM - in person (free pizza!) Register Here "Check in between 6:00 and 6:30 to network "About the Presentation. . . "Writing automated tests for a React Native mobile application is notoriously difficult. Mobile components display on the page, but are not fully loaded. Lengthy animations and slow-loading components take a while to finish. Timing issues cause your automated tests to error out giving the appearance of flaky tests. "Thomas F. - T.J. - Maher, Jr. will be sharing his experience tackling these problems using the open-source mobile testing framework, Wix's Detox, designed specifically for testing React Native applications. "Setting up a mobile test automation framework. "Vibe-coding a toy React Mobile Login page app to test against ( tinyurl.com/detox-demo ). "How to reduce timing issues and flakiness in automated tests. "Refactoring code into tests, page objects & base pages, separating out credentials and message strings for easier maintainability. "Setting up automated tests in CI / CD for iOS simulators and Android emulators with GitHub Action Workflows. "How developers can test their code before they push it into the main branch". About the Speaker. . . "A former organizer of Ministry of Testing - Boston, Thomas (T.J.) Maher is a Software Development Engineer in Test (SDET) based in the Boston/South Shore area of Massachusetts, with a decade of experience building web + mobile test automation frameworks. His recent work includes architecting a mobile automation framework from the ground up using Detox and TypeScript for a Re ## My IndieWeb Journey: A Guide to POSSE on a Hugo Static Site DevFeed: [My IndieWeb Journey: A Guide to POSSE on a Hugo Static Site]() Original publisher: [Read original article]() Author: Tom Published: 2026-01-27T00:00:00Z Content type: tutorial Language: en Sources: [Tomasz Gągor]() Topics: [IndieWeb](), [Hugo](), [Microformats](), [Giscus](), [GitHub]() Tags: [blog](), [brid-gy](), [building](), [github](), [github-action](), [guide](), [hugo](), [indieweb](), [journey](), [microformats](), [papermod](), [posse](), [static-site](), [syndication](), [web-development](), [webmentions]() ### AI overview A personal guide to applying IndieWeb principles to a Hugo blog through POSSE syndication. It describes cross-posting articles to social networks with a custom GitHub Action, discusses the limitations of comment systems such as Giscus, and emphasizes publishing on an owned site before syndicating elsewhere. ### Source excerpt My journey of integrating IndieWeb principles into my Hugo blog-from microformats to Brid.gy syndication and building a custom Webmention renderer. ## Running Renovate as a GitHub Action (and NO PAT!) DevFeed: [Running Renovate as a GitHub Action (and NO PAT!)]() Original publisher: [Read original article]() Published: 2026-01-19T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [renovate](), [GitHub Actions](), [octo sts](), [github personal access token](), [Security](), [maintenance]() Tags: [chainguard-containers](), [chainguard-images](), [dependabot](), [dependencies](), [github](), [github-action](), [github-pat-alternative](), [guide](), [maintenance](), [octo-sts](), [personal-access-token](), [renovate](), [run](), [security](), [software-supply-chain-security]() ### AI overview This tutorial explains how to run Renovate as a scheduled GitHub Action to update repository dependencies without using a long-lived GitHub Personal Access Token. It presents Octo STS as the replacement for the PAT and outlines the workflow setup. ### Source excerpt Discover how you can run Renovate as a GitHub Action without needing a GitHub Personal Access Token by using Octo STS. ## Mutation testing at Mercado Libre: From pilot to everyday guardrail DevFeed: [Mutation testing at Mercado Libre: From pilot to everyday guardrail]() Original publisher: [Read original article]() Author: Luram Archanjo Published: 2026-01-14T12:19:03Z Content type: article Language: en Sources: [Mercado Libre Tech]() Topics: [mutation-testing](), [Testing](), [GitHub](), [Pull Request](), [test-coverage]() Tags: [ci-cd-pipeline](), [code-quality](), [github](), [github-action](), [mutation-testing](), [pull-requests](), [software-engineering](), [software-quality-testing](), [test-coverage](), [testing]() ### AI overview Mercado Envíos integrated mutation testing into Mercado Libre's Fury pipelines using a multi-stack GitHub Action, delta-first execution focused on modified code, and gradual team-level gates. The article explains how this approach supplements coverage by identifying weak test assertions and aims to improve pull request quality and reduce regressions. ### Source excerpt Beyond coverage: How we integrated mutation testing into Fury pipelines and turned it into an actionable quality indicator for teams At Mercado Envíos (ME), we saw that high test coverage didn't always prevent regressions -- pull requests (PRs) were green, but we still broke production. In this article, we share how we brought mutation testing into our pipelines on Fury, our internal developer platform (IDP). We used a single multi-stack GitHub Action, a delta-first approach, and gradual team-level gates. We walk through the design decisions, challenges, and lessons learned that helped us turn this technique into an everyday guardrail that improves test effectiveness and PR quality. Introduction: Green PR, still an incident Friday, end of the day. You've got a green PR, pipelines are passing, and coverage looks great. You merge with confidence. On Monday, production goes down because of an edge case no one asserted. Sounds familiar? Same here. Coverage tells us what runs, not whether tests fail where they should. You can have 95-100% line coverage and still let a subtle regression slip -- a slightly wrong if condition, an unexpected default value, a branch with no assertions. That's where mutation testing comes in. Instead of assuming tests are good just because they pass, you intentionally introduce small code changes (mutants) and check whether the test suite kills them. In mutation testing, "killing a mutant" means your test suite fails when run on the mutated code, proving it can detect the injected defect. If mutants survive, you get a concrete indicator of weak assertions exactly in the area you're changing. At Mercado Envíos (ME), we moved from a one-off experiment to making mutation testing part of teams' daily flow. We integrated it into our standard pipelines on Fury, Mercado Libre's internal developer platform. We did it without breaking delivery: a single, multi-stack GitHub Action; delta-first execution focused on modified code; and team-level gates with ## Zsh 'illegal modifier' with Git Conventional Commits DevFeed: [Zsh 'illegal modifier' with Git Conventional Commits]() Original publisher: [Read original article]() Author: Tom Published: 2025-12-19T00:00:00Z Content type: tutorial Language: en Sources: [Tomasz Gągor]() Topics: [Zsh](), [Git]() Tags: [command-line-tip](), [commit](), [conventional-commits](), [errors](), [fzf](), [git](), [git-commit-error](), [github-action](), [history-expansion](), [linux](), [macos](), [no-bang-hist](), [shell-configuration](), [zsh](), [zsh-bang-history]() ### AI overview This tutorial explains how Zsh history expansion can cause "illegal modifier" errors when using Git Conventional Commits. It shows how disabling the NO_BANG_HIST option allows bang characters to be used in quoted commit messages. ### Source excerpt Fix ZSH 'illegal modifier' errors with Git Conventional Commits by disabling the NO_BANG_HIST option. ## Discover Roq, the Quarkus Way for Static Site Generation in Java DevFeed: [Discover Roq, the Quarkus Way for Static Site Generation in Java]() Original publisher: [Read original article]() Author: Andy Damevin Published: 2025-12-09T02:02:47Z Content type: tutorial Language: en Sources: [Java Advent Calendar]() Topics: [Quarkus](), [Java](), [Development](), [Tailwind CSS](), [gatsby](), [Jekyll]() Tags: [2025](), [cms](), [dev](), [github-action](), [hugo](), [java](), [javascript](), [jvm](), [quarkus](), [ssg](), [static-site-generator](), [tailwindcss](), [themes]() ### AI overview This tutorial introduces Roq, a static-site generator built as a thin layer on Quarkus for Java. It explains how Roq uses Quarkus features such as Qute templates, extensions, Dev Mode, plugins, themes, data files, and static-site export, then demonstrates setup and live reloading with a Quarkus, Roq, and Tailwind project. ### Source excerpt Did you know about Roq? A powerful new tool that combines Java and Quarkus. Ok, prep a warm drink and put on some soft music and let's find out why Roq is so cool with the comfort of Quarkus Dev Mode and all its eco-system. Bonus: a touch of TailwindCss to make it look great! The post Discover Roq, the Quarkus Way for Static Site Generation in Java appeared first on JVM Advent. ## Introducing setup-wash: A GitHub Action for installing the Wasm Shell CLI DevFeed: [Introducing setup-wash: A GitHub Action for installing the Wasm Shell CLI]() Original publisher: [Read original article]() Author: Bailey Hayes Published: 2025-08-20T00:00:00Z Content type: article Language: en Sources: [wasmCloud Blog]() Topics: [GitHub Actions](), [wasm](), [GitHub](), [Command-line interface](), [TypeScript](), [Development]() Tags: [build](), [cli](), [github-action](), [github-actions](), [typescript](), [wasm](), [wasm-components]() ### AI overview The article introduces setup-wash, a GitHub Action that installs the Wasm Shell CLI for building and publishing Wasm components in workflows. It explains how the action was developed and compares Docker container, TypeScript, and composite Action approaches. ### Source excerpt Introducing setup-wash, a GitHub Action for installing the Wasm Shell CLI, plus lessons learned comparing TypeScript, container, and composite Actions. ## Blog: Detecting Supply Chain Attacks with Falco Actions DevFeed: [Blog: Detecting Supply Chain Attacks with Falco Actions]() Original publisher: [Read original article]() Published: 2025-03-19T00:00:00Z Content type: tutorial Language: en Sources: [Falco - Falco](), [Falco - The Falco blog]() Topics: [supply chain attacks](), [GitHub Actions](), [Security](), [GitHub](), [Containers](), [Kubernetes](), [Linux Kernel]() Tags: [cicd](), [falco](), [github-action](), [github-actions](), [kubernetes](), [linux](), [linux-kernel](), [pull-request](), [runtime-security](), [security](), [software-supply-chain](), [supply-chain-attacks](), [supplychain]() ### AI overview This tutorial explains how to use Falco Actions in GitHub Actions workflows to detect suspicious behavior and software supply chain attacks in CI/CD pipelines. It covers runtime monitoring, custom rules, workflow setup, findings, and generated reports. ### Source excerpt The recently discovered CVE for the GitHub action tj-actions/changed-files brought to light a topic that is really critical for companies: supply chain attacks. With that, we want to discuss and show a bit about how Falco can help your organization detect this kind of attack and other suspect behaviors inside your CI/CD pipeline. What is Falco? Falco is a cloud native security tool that provides runtime security across hosts, containers, Kubernetes, and cloud environments. It leverages custom rules on Linux kernel events and other data sources through plugins, enriching event data with contextual metadata to deliver real-time alerts. Falco enables the detection of abnormal behavior, potential security threats, and compliance violations. What is Falco Actions? Falco Actions enable you to run Falco in GitHub Actions to detect suspicious behavior in your CI/CD workflows. If you run it in a pull request, the action will create a comment with the findings. Thanks to ad-hoc Falco rules specific to this use case, these GitHub actions can monitor your GitHub runner and detect software supply chain attacks. Using Falco Actions To have Falco inside your pipeline, you need to add these two actions: falcosecurity/falco-actions/start falcosecurity/falco-actions/stop Below you can see an example: name: CI on: push: pull_request: jobs: build: runs-on: ubuntu-latest permissions: contents: read actions: read steps: - uses: actions/checkout@v4 - name: Start Falco uses: falcosecurity/falco-actions/start@main with: mode: live falco-version: '0.40.0' verbose: true - name: My Custom Step run: | echo "This is my custom step" - name: Stop Falco uses: falcosecurity/falco-actions/start@main with: mode: live verbose: true OBS: main is being used here only to simplify how it works, you should always pin your dependencies to a specific commit SHA. After the execution, you will be able to see the results at the github action summary. If you want a more detailed report, you can use the action fal ## An API to Track Database Schema Changes DevFeed: [An API to Track Database Schema Changes]() Original publisher: [Read original article]() Author: Luis Tavares Published: 2025-01-09T17:08:23Z Content type: article Language: en Sources: [Blog -- Neon Docs]() Topics: [API](), [schema-evolution](), [Database Migration](), [Databases](), [Repl.it](), [CI/CD](), [GitHub Actions](), [Artificial Intelligence](), [Large Language Model]() Tags: [agentic](), [api](), [ci-cd](), [database](), [github](), [github-action](), [llms](), [migration](), [postgres](), [product](), [schema-evolution]() ### AI overview The article introduces the compare_schema API endpoint for Neon's Schema Diff feature. It explains how the API compares schemas between Neon databases and supports CI/CD automation, agentic systems, database migrations, and schema evolution, including use cases involving Replit Agent and Postgres. ### Source excerpt We keep expanding our Schema Diff feature, this time adding an API endpoint: compare_schema. You can use it in all your Neon projects, including the Free Plan. Schema Diff allows you to easily compare schemas between Neon databases. It was first made available via the Neon Consol... ## CI CD for OpenHarmony Project -- GitHub Action DevFeed: [CI CD for OpenHarmony Project -- GitHub Action]() Original publisher: [Read original article]() Author: Payam Zahedi Published: 2024-12-09T12:05:48Z Content type: tutorial Language: en Sources: [Snapp Mobile - Medium]() Topics: [GitHub Actions](), [CI/CD](), [GitHub](), [Development]() Tags: [ark-ts](), [build](), [building](), [ci-cd](), [ci-cd-pipeline](), [ci-cd-workflows](), [github](), [github-action](), [github-actions](), [harmony-os](), [open-harmony](), [sdk](), [testing](), [verify]() ### AI overview This tutorial explains how to create a GitHub Actions CI/CD workflow for building and verifying an OpenHarmony application. It introduces the roles of DevEco Studio, Hvigor, OHPM, the OpenHarmony Code Linter, and the reusable oh-action for preparing the required SDK and command-line tools. ### Source excerpt CI CD for OpenHarmony Project -- GitHub Action When developing OpenHarmony, we typically use DevEco Studio to write our code, build the project, test it, and run it on our devices, with DevEco Studio taking care of everything under the hood. However, as engineers, we love to automate repetitive processes, right? This is where CI/CD workflows become incredibly useful. GitHub Actions, in particular, is a popular and highly customizable workflow solution. In this article, we'll explore how to create a workflow on GitHub Actions to build and verify our OpenHarmony application. A Little Context To write our GitHub Action workflow, we first need to understand how DevEco Studio works under the hood. Specifically, what tools does it install, and how are they used? In this article, we won't dive too deep into all OpenHarmony tools and DevEco Studio capabilities. Instead, we'll provide a brief overview to understand the components needed for our workflow. hvigorw Hvigor is a simple build tool, much like Gradle for Android, but designed specifically for OpenHarmony apps. It helps you manage tasks, dependencies, and builds easily. DevEco Studio uses hvigorw to build, test, and run apps on devices. ohpm OHPM (OpenHarmony Package Manager) is akin to npm for JavaScript, but tailored for OpenHarmony applications. It helps facilitate the publishing, installation, and management of dependencies for shared packages. DevEco Studio uses OHPM to manage third-party libraries within OpenHarmony projects. Code Linter OpenHarmony's Code Linter is a tool that checks ArkTS and TypeScript code for best practices and coding standards. It helps developers identify and fix issues during development, ensuring high-quality code. Now that we have a good understanding of the tools involved, the next step is to bring these components together into a cohesive GitHub Action that can automate our workflow. This is where oh-action steps in. GitHub - Snapp-Mobile/oh-action: The oh-action is a GitHub Action t ## Webmentions and POSSE improvements DevFeed: [Webmentions and POSSE improvements]() Original publisher: [Read original article]() Published: 2024-08-07T21:14:00Z Content type: article Language: en Sources: [Jeremy Kun]() Topics: [Webmentions](), [Bluesky](), [Mastodon](), [X (Twitter)](), [github action](), [Algolia]() Tags: [algolia](), [bluesky](), [github-action](), [indieweb](), [mastodon](), [posse](), [shortform](), [twitter](), [webmentions]() ### AI overview The article describes improvements to a blog's webmention and POSSE system. Shortform posts are syndicated to Mastodon, Bluesky, and Twitter, with syndicated links automatically added to posts. It also discusses GitHub Actions for sending and rendering Hacker News webmentions, while noting limitations related to the Algolia search API and uncertainty about future automation. ### Source excerpt This blog now accepts webmentions. I used webmention.io and webmention.js for live rendering. You can see an example at the end of my old Bezier Curves post. After my initial experiments with POSSE, I've made a few improvements to the system. Now shortform posts are syndicated to Mastodon, Bluesky, and Twitter, and the links to the syndicated posts are automatically added to the end of each post. I don't have any automatic social media posting for longform posts yet, though I plan to add a very simple version of that soon. ## Experiments with POSSE DevFeed: [Experiments with POSSE]() Original publisher: [Read original article]() Published: 2024-05-13T03:28:54Z Content type: opinion Language: en Sources: [Jeremy Kun]() Topics: [Mastodon](), [Hugo](), [GitHub Actions](), [Netlify](), [GitHub](), [GitHub API](), [static-site-generator](), [Python](), [Serverless](), [Markdown](), [Command-line interface]() Tags: [cli](), [github](), [github-action](), [github-actions](), [hugo](), [indieweb](), [markdown](), [mastodon](), [netlify](), [posse](), [python](), [shortform]() ### AI overview The author describes an experiment that automates POSSE syndication by converting Hugo shortform posts into Mastodon threads. Netlify triggers a serverless function, which uses the GitHub API to start a GitHub Actions workflow; a Python script parses Markdown, publishes the thread through Mastodon.py, and records URL mappings in the repository. ### Source excerpt POSSE stands for Publish (on your) Own Site, Syndicate Elsewhere. I first heard about it from Cory Doctorow. I'm experimenting with automation to convert posts tagged shortform into Mastodon threads (I'm mathstodon.xyz/@j2kun). I'm using Hugo as a static site generator, with the source a (private) GitHub repository, and Netlify for deployments. After a deployment, Netlify calls a serverless function that hits the GitHub API with a POST request to trigger a GitHub action workflow. ## Gradle partners with GitHub on supply chain security DevFeed: [Gradle partners with GitHub on supply chain security]() Original publisher: [Read original article]() Author: Gradle Build Tool Published: 2024-04-18T04:00:00Z Content type: news Language: en Sources: [The Gradle Blog]() Topics: [Gradle](), [GitHub](), [supply-chain-security](), [Dependency management](), [Security](), [Developer experience]() Tags: [dependabot](), [dependencies](), [dependency-management](), [github](), [github-action](), [gradle](), [integrity](), [security](), [supply-chain-security]() ### AI overview Gradle and GitHub announce a technical partnership focused initially on software supply chain security and developer experience. The first feature is a Gradle dependency submission GitHub Action that automatically sends project dependencies to GitHub's dependency graph, helping users understand dependencies and receive Dependabot alerts. ### Source excerpt Gradle is happy to announce a technical partnership with GitHub focusing on multiple areas, starting with supply chain security and developer experience. With this partnership, we establish a direct connection between organizations and plan to cooperate on integrations between GitHub and Gradle to promote best security practices among Gradle users. The first feature being released as a part of this partnership is the dependency submission GitHub Action for Gradle, which can be configured to automatically submit dependencies to GitHub's dependency graph, helping users better understand their application and receive Dependabot alerts. This partnership will improve the experience of many users within the shared Gradle and GitHub ecosystem. GitHub is the world's leading AI-powered developer platform to build, scale, and deliver secure software, home to more than 284 million public repositories. Gradle Build Tool is the default build system for Android application development, the most used JVM build system on GitHub, and among the most used build systems on the GitHub platform across public and private repositories. "Gradle is one of the most used build tools among GitHub users, and we're excited to continue to collaborate with them to improve supply chain security for the Gradle community. These updates to the Gradle Build Action will help millions of GitHub users improve the security of their apps by giving them better insights into their dependencies." - Jon Janego, Senior Product Manager at GitHub The problem with vulnerable dependencies Vulnerable project dependencies are a major risk for the software ecosystem. It's critical for developers to quickly detect potential vulnerabilities arising from both direct and transitive dependencies. It is a priority for many modern build systems, including Gradle, to help developers manage their dependencies and protect the supply chain and end users. Gradle Build Tool provides advanced security features like dependency verific ## Keep your Chainguard Images up to date with digestabot DevFeed: [Keep your Chainguard Images up to date with digestabot]() Original publisher: [Read original article]() Published: 2023-12-18T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [chainguard](), [GitHub Actions](), [Pull Request](), [Security]() Tags: [also](), [chainguard](), [chainguard-images](), [container](), [continuous-integration](), [digestabot](), [dockerfiles](), [github-action](), [helm](), [make](), [merge](), [oidc](), [security](), [vulnerability-automation](), [vulnerability-management]() ### AI overview Chainguard's digestabot is a free GitHub Action that helps keep Chainguard Images and other container assets current. It detects outdated image digests, opens pull requests, and supports testing and secure updates through continuous integration and optional ephemeral OIDC tokens. ### Source excerpt Experience hassle-free updates with Chainguard's digestabot, ensuring your Images stay secure and up-to-date daily. ## What's new in Astro - October 2023 DevFeed: [What's new in Astro - October 2023]() Original publisher: [Read original article]() Author: Elian Van Cutsem Published: 2023-10-31T00:00:00Z Content type: article Language: en Sources: [The Astro Blog]() Topics: [Astro](), [releases](), [Documentation](), [Hacktoberfest](), [view transitions](), [GitHub]() Tags: [astro](), [contributions](), [github](), [github-action](), [hacktoberfest](), [releases](), [testing](), [view-transitions]() ### AI overview Astro's October 2023 update covers Astro 3.2, 3.3, and 3.4 releases, Starlight 0.11, Hacktoberfest contributions, documentation work, community awards, and Astro Core presentations at ViteConf 2023. ### Source excerpt Another busy month in Astro! From Hacktoberfest to releasing Page Partials. Read up on everything that happened this month in the Astro universe. ## Conquering your Build Horizon DevFeed: [Conquering your Build Horizon]() Original publisher: [Read original article]() Published: 2023-10-10T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Automation](), [rego](), [CI/CD](), [Security](), [Vulnerabilities](), [GitHub Copilot]() Tags: [architecture](), [automation](), [base-images](), [build-horizon](), [chainguard-images](), [config](), [container-images](), [defense-in-depth](), [dependencies](), [github-action](), [rego](), [security](), [vulnerability]() ### AI overview The article presents Build Horizon, a policy that limits how long build artifacts such as binaries and container images may remain in production before being rebuilt. It explains how freshness controls, dependency automation, and policy checks can reduce risks from outdated software and long-lived builds. ### Source excerpt "Build Horizon" is a practice that imposes a maximum age on build artifacts. Learn more about how it works and see an example in action! ## nixbuild.net Expands Biscuit Token Usage with Signed Build Links and Access Policies DevFeed: [nixbuild.net Expands Biscuit Token Usage with Signed Build Links and Access Policies]() Original publisher: [Read original article]() Author: support@nixbuild.net Published: 2023-09-22T00:00:00Z Content type: release Language: en Sources: [nixbuild.net blog]() Topics: [API](), [Authentication](), [Authorization](), [Nix](), [builds](), [GitHub](), [Command-line interface]() Tags: [api](), [authentication](), [authorization](), [build](), [cli](), [github-action](), [http](), [ssh](), [web]() ### AI overview The article announces expanded use of Biscuit authorization tokens in nixbuild.net. It describes signed links for accessing build details and logs, advanced access policies, and token-based SSH authentication, with tokens restricted by permissions, expiration, and build-specific scope. ### Source excerpt About one year ago, we introduced an HTTP API for nixbuild.net. This API can be used to retrieve information about the builds you've run on the service. One place where the API is used is in the GitHub Action nixbuild-action to create detailed build summaries at the end of workflow runs. When the API was launched, it was using Biscuit auth tokens to handle authentication and authorization. In the initial implementation, we didn't really take much advantage of Biscuit, and basically used them as plain API keys. This week, however, we've finally expanded our Biscuit usage to properly take advantage of the flexibility offered. Read on to find out how this allows us to now support advanced access policies, token-based SSH auth and signed web links that gives easy access to build logs and fancy build reports. Signed Web Links Let's start out with the feature we're really happy to launch: signed web links. To show how it works, I grep for a broken package in nixpkgs and find one called textpieces. Then I try building it on my laptop which has been setup to use nixbuild.net as a remote builder (we need NIXPKGS_ALLOW_BROKEN=1 and --impure in order to force Nix to evaluate the broken package): $ NIXPKGS_ALLOW_BROKEN=1 nix build --impure nixpkgs#textpieces error: build of '/nix/store/s7ns32ymdf9iq44hpa62dkdbwlhvc7nx-textpieces-3.4.1.drv' on 'ssh://eu.nixbuild.net' failed: builder for '/nix/store/s7ns32ymdf9iq44hpa62dkdbwlhvc7nx-textpieces-3.4.1.drv' failed with exit code 1 error: builder for '/nix/store/s7ns32ymdf9iq44hpa62dkdbwlhvc7nx-textpieces-3.4.1.drv' failed with exit code 1; last 10 log lines: > upgrade: Use the '$' extern syntax introduced in blueprint 0.8.0 > at ../resources/ui/CustomToolPage.blp line 43 column 3: > 43 | .TextPiecesToolSettings tool_settings { > | ^ > error: Cannot convert 2.5 to integer > at ../resources/ui/Editor.blp line 45 column 26: > 45 | margin-bottom: 2.5; > | ^ > ninja: build stopped: subcommand failed. > [nixbuild.net] See this link for bui ## Running your Maestro Flows on GitHub Actions DevFeed: [Running your Maestro Flows on GitHub Actions]() Original publisher: [Read original article]() Author: Leland Takamine Published: 2022-12-15T08:00:00Z Content type: tutorial Language: en Sources: [mobile.dev - Medium]() Topics: [GitHub Actions](), [GitHub](), [ci](), [API keys](), [Cloud](), [configuration]() Tags: [account](), [android](), [api](), [ci](), [configuration](), [github-action](), [github-actions](), [how-to](), [integrations](), [maestro](), [repo](), [secrets](), [workflow](), [workflows]() ### AI overview A tutorial explaining how to run Maestro Flows in CI with GitHub Actions. It covers creating a Maestro Cloud account, storing the API key as a GitHub repository secret, committing Flow files, and updating workflows for Android and iOS. ### Source excerpt Maestro is compatible with all CI systems and provides native integrations with a number of common providers including GitHub Actions. You can start running your Flows in CI wit... ## Running a blog with iPad DevFeed: [Running a blog with iPad]() Original publisher: [Read original article]() Author: Marco Gomiero Published: 2021-01-11T00:00:00Z Content type: article Language: en Sources: [Posts on Marco Gomiero]() Topics: [Hugo](), [Markdown](), [GitHub Pages](), [GitHub](), [hosting]() Tags: [blog](), [github](), [github-action](), [github-pages](), [hugo](), [markdown](), [static-site-generator]() ### AI overview The author explains a personal writing setup for maintaining a blog with an iPad, alongside the site's Hugo-based technology stack. The blog uses Markdown content, is built into a static website, and is published through a GitHub Action to GitHub Pages. ### Source excerpt It's been a few years since I started writing this blog, and I quite like sharing my thoughts and experiences. After a short while spent on Medium, I decided I wanted to be the sole owner of my content, so I started experimenting with different solutions and ideas. After I finally landed on the "perfect" tech architecture (I know, I'm lying. There's no perfect solution and Future Me will most likely refactor and (over)re-engineer the current solution), I started to seek the "perfect" writing setup. ## The Life of a GitHub Action DevFeed: [The Life of a GitHub Action]() Original publisher: [Read original article]() Published: 2019-01-13T15:09:26Z Content type: tutorial Language: en Sources: [Jessie Frazelle]() Topics: [GitHub](), [Code](), [Pull Request]() Tags: [branch](), [cleanup](), [code](), [github](), [github-action](), [pull-request](), [repository](), [workflow]() ### AI overview This tutorial explains what happens when a GitHub Action runs, using a workflow that deletes a repository branch after its pull request is merged. It introduces the workflow file, triggering pull request events, and the Action execution flow. ### Source excerpt I thought it might be fun to write a blog post on "The Life of a GitHub Action." When you go through orientation at Google they walk you through "The Life of a Query" and it was one of my favorite things. So I am re-applying the same for a GitHub Action. For those unfamiliar Actions was a feature launched at GitHub's conference Universe last year. You can sign up for the beta here. The overall idea is scriptable GitHub but rather than do all that hand-wavy crap to try and explain I will take you through what happens when you run an Action. The Problem Here is a typical workflow: I create a pull request on a repository. The pull request is merged. The branch lingers around until the end of time and eats away at the part of my soul that likes everything to be clean. Let's focus on my pain of the lingering branches. This is totally a problem right? So let's solve it by creating an Action to delete branches after the pull request has been merged. All the code for this action lives here if you want to skip ahead. The Workflow File You can create actions from the UI or you can write the Workflow file yourself. In this post, I am just going to use a file. Here is what it ends up looking like and I will explain what everything means in comments on the file. This lives in .github/main.workflow in your repository. ## Workflow defines what we want to call a set of actions. workflow "on pull request merge, delete the branch" { ## On pull_request defines that whenever a pull request event is fired this ## workflow will be run. on = "pull_request" ## What is the ending action (or set of actions) that we are running. ## Since we can set what actions "need" in our definition of an action, ## we only care about the last actions run here. resolves = ["branch cleanup"] } ## This is our action, you can have more than one but we just have this one for ## our example. ## I named it branch cleanup, and since it is our last action run it matches ## the name in the resolves section above. a