GitHub Actions - Scrum Bug

Sign in Subscribe

GitHub Actions

A collection of 20 posts

A trust checklist for GitHub Actions

A trust checklist for GitHub Actions

Every action you reference in a workflow runs on your runner, with access whatever token you hand it. `uses: some-org/some-action@v3` is an instruction to execute someone else's code. It deserves at least as much scrutiny as a production dependency, and receives considerably less.

Introducing Azure DevOps Marketplace tasks and actions: A Complete Rebuild for Speed, Stability, and Security

GitHub Actions Featured

Introducing Azure DevOps Marketplace tasks and actions: A Complete Rebuild for Speed, Stability, and Security

Introducing the Azdo marketplace project. Azure Pipelines tasks and GitHub Actions for publishing to the Azure DevOps marketplace.

Keep your examples in sync with your Action

Keep your examples in sync with your Action

Last month I added a few more GitHub Actions to the Marketplace and while working on them found that it was easy to forget to update my examples as the implementation of the Action evolved

Automatic versioning for GitHub Actions authors

GitHub Actions Featured

Automatic versioning for GitHub Actions authors

As a maintainer of 3 GitHub Actions, I've always struggled a bit with the versioning of them. GitHub's documentation provides guidance, but no easy way to verify you did everything right. Based on a quick scan of the actions on the marketplace I'm not alone, even GitHub's own actions have some.

Improved Dependency Submission for GitHub Actions

Improved Dependency Submission for GitHub Actions

Recently someone brought to my attention that when pin your actions, Security Advisories for GitHub actions do not show up in the Dependency Graph. I set about a solution to solve that problem.

GitHub Billing - Let Organization and Repository admins set the Cost Center in GitHub

GitHub Billing - Let Organization and Repository admins set the Cost Center in GitHub

We rely on GitHub Cost Centers to split the GitHub bill across the different entities that make up our company. What resource is tied to which cost center is managed in the GitHub Enterprise Settings.

GitHub Actions learnings from the recent nx hack

GitHub Actions Featured

GitHub Actions learnings from the recent nx hack

You may have seen recent reporting around the compromise of the nx project. A malicious version of their package was published to npmjs which subsequently published GitHub tokens, crypto wallets and other sensitive materials of 1000s of users.

Azure sky with pink cloud. Connecting to "Azure" afterall.

Authenticate Connect-MgGraph using OIDC in GitHub Actions

I'm running a number of maintenance scripts against our Azure EntraId to manage GitHub related things. Removing dormant users, asking users to setup their notification email correctly etc. For a long time, I ran these scripts with an interactive session, before moving them over to GitHub Actions. Recently

(repost) Protect the repository hosting your GitHub Action

GitHub Featured

(repost) Protect the repository hosting your GitHub Action

This post, now 2 years old, is still very valid, especially in light of the changed-files hack recently.

Scan all workflow artifacts for leaked secrets

Scan all workflow artifacts for leaked secrets

In response to: Major GitHub repos leak access tokens putting code and clouds at riskBuild artifacts generated by GitHub Actions often contain access tokens that can be abused by attackers to push malicious code into projects or compromise cloud infrastructure.CSO OnlineLucian Constantin I've created a quick powershell

Looking back on the Global DevOps Experience

It's been a few weeks since the Global DevOps Experience 2024 finished, but it's a lot longer since we all started back in March.

Recommendations for using Azure CLI in your workflow

Azure Pipelines

Recommendations for using Azure CLI in your workflow

Azure CLI is widely used in GitHub Actions and Azure Pipelines, as well as many other CI/CD tools. Over the last few weeks, I've been looking into its performance and security and based on that here are a number of recommendations.

Investigating az-cli performance on the hosted Azure Pipelines and GitHub Runners

GitHub Featured

Investigating az-cli performance on the hosted Azure Pipelines and GitHub Runners

I've been building a few more workflows and pipelines over the past few days and had been experimenting with the az-cli. And I've been running into all kinds of performance issues.

Protect the repository hosting your GitHub Action

GitHub Actions Featured

Protect the repository hosting your GitHub Action

It comes as no surprise that the tags and branches solution to version GitHub Actions is weak at best. There have been rumors of Actions moving to a different model (GitHub Container Registry), but that is yet to see the light.

Issuing workflow commands from the Windows shell in GitHub Actions

Issuing workflow commands from the Windows shell in GitHub Actions

I don't think you should, I'm not sure you want to... But in case you need to... Here's how to correctly issue a GitHub Actions workflow command from the windows shell.

Update Ghost blogs and pages with PowerShell

Update Ghost blogs and pages with PowerShell

In order to remove a bit of repetitive manual work from my schedule I wrote a little sync between my Scrum.org class schedule to this blog.

Upgrade Hosted Agent / GitHub Runner PowerShell

Upgrade Hosted Agent / GitHub Runner PowerShell

I had recently fixed a bug in one of my build scripts by upgrading to the latest PowerShell Preview version. Of course, that version isn't yet available on the hosted agent for Azure Pipelines and GitHub Actions.

Be Secure and Compliant with GitHub

Be Secure and Compliant with GitHub

How do we ensure security after we have deployed our application? This question comes up in many customer engagements. How do we make something secure and how can we ensure we are compliant? Unfortunately, many of these questions arise after the fact. After the application has been built, or even

Can't push to GitHub "Refusing to allow an OAuth App to create or update workflow without workflow scope"

Can't push to GitHub "Refusing to allow an OAuth App to create or update workflow without workflow scope"

When any of your commits contain a new or updated GitHub Action, you need to have the `workflow` scope to push these changes. Git Credential Manager for Windows doesn't request this.

What to do when your build hangs on the Hosted Pool...

Azure Pipelines

What to do when your build hangs on the Hosted Pool...

When your build freezes and you can't remote into the agent... You're basically blinded...