CI/CD

GitHub Actions added a $/ prefix that resolves a same-repository action or reusable workflow at the exact commit being run, with no checkout. It fixes the pinning trap that made enterprise SHA-pinning policies hard to satisfy for a repo's own actions.

A security researcher found a GitHub personal access token with admin privileges to hundreds of repos baked into Hanwha Vision camera firmware. The cause: a Vite build leaking process.env into production.

ByteDance's Dockerless paper asks whether coding-agent patches can be verified without spinning up per-repo environments. The practical answer is not replace CI. It is use cheaper evidence before CI.

A fair comparison of running Claude Code, OpenAI's Codex CLI, Gemini CLI, and opencode in non-interactive CI pipelines: invocation flags, sandboxing, auth, and output formats.

codex exec is OpenAI's non-interactive mode for running Codex agents from scripts, CI pipelines, and GitHub Actions - here is how to set it up safely with real flags and working YAML.

The Miasma worm has evolved from package registry poisoning to directly hijacking AI coding tools - if your team clones open-source repos and opens them in Claude Code, Cursor, Gemini CLI, or VS Code, you may already be compromised.

Hugging Face shipped mlinter, the first credible CI tool for transformers modeling code. Here is how to add it to your pipeline today and where it fits the agent stack.