https://www.msbiro.net/tags/github-actions/ Recent content in Github-Actions on Cloud Native & Open Source: A Team Lead’s Working Journal https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E https://www.msbiro.net/%3Clink%20or%20path%20of%20image%20for%20opengraph,%20twitter-cards%3E Hugo -- 0.164.0 en-us Sun, 26 Apr 2026 12:00:00 +0100 https://www.msbiro.net/posts/supply-chain-attack-prevention-8-controls/ Sun, 26 Apr 2026 12:00:00 +0100 https://www.msbiro.net/posts/supply-chain-attack-prevention-8-controls/ Bitwarden CLI, Trivy, and Axios compromised in three weeks. Your EDR won't catch postinstall scripts. 8 practical controls to reduce the blast radius. https://www.msbiro.net/posts/actui-security-hardening-dependabot-openssf-scorecard/ Thu, 02 Apr 2026 08:00:00 +0000 https://www.msbiro.net/posts/actui-security-hardening-dependabot-openssf-scorecard/ Back from KubeCon EU 2026 with a free Copilot Pro+ subscription, I turned my attention to the security posture of apple-container-tui. Here's how I added Dependabot and OpenSSF Scorecard using GitHub Actions, spec-kit, and the GitHub CLI. https://www.msbiro.net/posts/trivy-supply-chain-attack/ Sat, 21 Mar 2026 07:32:37 +0000 https://www.msbiro.net/posts/trivy-supply-chain-attack/ A comprehensive analysis of the March 2026 Trivy supply chain incident: from malicious GitHub Actions to the self-propagating CanisterWorm.