Python 3.15.0 lands in GitHub Actions: a CI supply-chain checklist
Python 3.15.0 is now in actions/python-versions, so teams can add it to CI test matrices. It's a routine moment to check how much of your build pipeline silently trusts a moving interpreter.
GitLost: A Public GitHub Issue Tricked an Agentic Workflow Into Leaking Private Repos
Noma Labs showed that a GitHub Agentic Workflow with cross-repository read access could be steered by a crafted issue into posting private repository content as a public comment. The flaw is architectural, and it applies to any AI agent in CI/CD that reads untrusted text.
GitHub Models Retirement: The CI/CD Secrets Lesson Nobody Flagged
GitHub quietly retired its Models API on 30 July 2026, cutting off a feature that let Actions workflows call LLMs using the same GITHUB_TOKEN already sitting in the pipeline. That convenience is worth a second look.
AI Writes the CI/CD Pipeline: Auditing AI-Generated GitHub Actions Workflows
Simon Willison's browser-compat-db used two AI models to generate a complete build pipeline — a sign of where development is heading and a prompt to ask whether security review has kept pace.