tag: Supply-Chain · 41 items
- Platform/SRE — Skip
- CI/CD — Plan: Evaluate enabling Dependabot reachability analysis to triage which vulnerable dependencies are actually callable from your code, reducing alert noise and helping the team focus remediation effort on real exposure.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: GitHub Apps can now replace classic PATs for enterprise-wide automation; schedule an audit of existing PAT-based pipeline credentials and migrate to GitHub App installations for tighter scope and auditability — no forced deadline, but a clear security improvement to queue this quarter.
- Leader — Learn: This GA capability enables org-wide policy to standardize on GitHub Apps over classic PATs for automation, which strengthens credential hygiene and reduces blast radius of leaked tokens; worth factoring into enterprise GitHub governance standards but no immediate decision required.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Learn: The new
version_requirementfield in Dependabot alert API responses enables richer automated triage — useful when designing pipeline workflows that parse alerts for version-specific remediation logic, but nothing to change today. - Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: If your pipelines use npm 12, pnpm 11/12, or Bun 1.4, you can now upgrade those package managers without losing Dependabot coverage — schedule the version bumps in your lockfiles and CI configs this quarter.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: New GA GitHub Enterprise Cloud feature enables ruleset-based OSS license checks in pipelines; schedule evaluation to enforce centralized license policy as a supply-chain hardening step this quarter.
- Leader — Plan: GA tooling for enforcing OSS license policy at scale on GitHub Enterprise Cloud directly addresses legal/compliance risk from dependency licensing; evaluate enabling it as a formal org standard this planning cycle.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Learn: Arch Linux achieving bit-for-bit reproducible Docker images is a meaningful supply-chain milestone worth tracking as the ecosystem moves toward verifiable builds; no pipeline changes needed today.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: GitHub’s AI Scan for PRs is now GA, extending code vulnerability detection to languages and frameworks CodeQL doesn’t cover — evaluate enabling it in your GitHub Actions workflows this quarter to broaden supply-chain security coverage.
- Leader — Plan: GA availability makes this worth adding to your security standards: assess whether to mandate AI Scan alongside CodeQL as part of the org’s golden-path security policy for pull requests.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Learn: Workflow lockfiles for GitHub Enterprise Cloud will help pin action versions to prevent silent drift — worth evaluating once GA, but pre-GA preview status caps this at Learn for now.
- Leader — Skip
- Signals: pre-GA (alpha/beta/RC/preview)
- Platform/SRE — Skip
- CI/CD — Plan: Verify your repositories have push protection enabled and audit any existing Anthropic API keys or Salesforce credentials in build logs or secrets; no deadline but this is a worthwhile supply-chain hardening step to schedule.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: Dependabot alert lifecycle (withdrawn vs. active) is relevant to supply-chain workflows, and understanding when alerts are auto-removed helps CI/CD engineers avoid chasing invalid findings — but no pipeline changes or deadlines are involved.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: If your org runs internal package mirrors accessible without credentials, configure the new Anonymous auth method at the org level to simplify Dependabot registry setup and reduce credential management overhead.
- Leader — Skip
- Platform/SRE — Learn: Pre-GA feature that adds pusher identity to commit metadata; worth watching for audit and access-control use cases once it reaches GA.
- CI/CD — Learn: Pre-GA; when GA, push attribution could strengthen supply-chain audit trails by distinguishing who pushed versus who authored a commit in pipeline contexts.
- Leader — Skip
- Signals: pre-GA (alpha/beta/RC/preview)
- Platform/SRE — Skip
- CI/CD — Learn: Early access (pre-GA cap applies), but the framing is worth noting: AI coding agents autonomously pulling unreviewed dependencies represent a new attack surface in the build path. Dependency firewalling at the point of install — before SCA can catch what’s already landed — is a supply-chain hardening pattern to track as the feature matures toward GA.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: This new GitHub feature lets teams discuss vulnerability reports privately within the advisory workflow, improving coordination before public disclosure — worth noting for teams managing CVE triage in GitHub repos.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: If you query the GitHub Advisory Database in pipeline tooling or vulnerability-scanning automation, these new fields let you replace REST fallbacks with a single GraphQL query — worth noting for future tooling improvements.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: The ConfigPoisoning class — attacker-controlled execution via .git/config and .gitattributes — is worth understanding when hardening pipelines that clone external or untrusted repos; the specific exploit requires the DeepSeek-Reasonix desktop client, but GitLab notes multiple coding agents share the same root flaw.
- Leader — Plan: GitLab’s research found the ConfigPoisoning class affects multiple widely-used AI coding agents, not just DeepSeek-Reasonix; if the org is standardizing on AI coding assistants, add security vetting of approved tools to the golden-path policy before broad rollout.
- Signals: CVE-2026-102437 — CISA KEV: not listed, EPSS 0.01
- Platform/SRE — Skip
- CI/CD — Plan: New GA capability lets npm trusted publishing configs manage dist-tags (latest, next, beta promotion) with short-lived OIDC credentials instead of long-lived tokens — schedule adoption to reduce static secret exposure in publish workflows.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: Docker’s agent isolation primitives (Sandboxes, Kits) could inform future pipeline sandboxing strategy, but these are conference-keynote announcements with no GA tooling to act on yet.
- Leader — Skip
- Platform/SRE — Plan: Review any SSH keys used for infrastructure automation against GitHub repos (deploy keys, Ansible/Terraform git sources) to confirm they meet the new algorithm and minimum RSA key-size requirements before the removals take effect; no hard deadline is published yet.
- CI/CD — Plan: Audit SSH deploy keys and runner SSH credentials used to pull private repos or push artifacts via GitHub to ensure they use accepted algorithms and sufficiently large RSA keys; schedule rotation for any that don’t comply before the removal lands.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: Adopt the new ‘stage only’ permission when minting npm automation tokens to enforce least-privilege publishing; schedule a rotation of existing CI npm tokens to apply the tighter scope and reduce blast radius from a leaked credential.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: New GA GitHub Actions feature lets you scope cache read/write permissions per workflow or job, reducing blast radius of a compromised workflow. Evaluate and adopt cache-mode across pipelines this quarter as a supply-chain hardening step.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: Dependabot can now pull from private GitHub Packages registries without a PAT, using the existing ‘Manage Actions access’ permission — evaluate removing hardcoded tokens from Dependabot config to simplify credential management and reduce secret sprawl.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: Multiple trusted publishing configurations per npm package are now GA on GitHub, enabling more flexible provenance-backed release workflows; schedule a review of existing npm publish pipelines to adopt multi-config trusted publishing and reduce reliance on long-lived tokens.
- Leader — Skip
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Plan: Audit build scripts, custom GitHub Actions, and any Node.js-based pipeline tooling for vm2 usage; if found, update to 3.11.7 and disable require.external — the blog post describes a working exploit path (CVSS 10.0), so exposure is concrete even without a KEV entry. No forced deadline, but the publicly documented exploit makes this a near-term project, not a watch item.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: If your pipelines use CodeQL scanning, upgrading to 2.26.4 improves detection coverage for GitHub Actions security issues and adds Go 1.27 support — schedule the version bump this quarter.
- Leader — Skip
- Platform/SRE — Learn: Docker’s extended security coverage and source-built images could reduce CVE surface on base images, but no EOL date or forced migration anchor exists — worth evaluating at next image refresh cycle.
- CI/CD — Learn: Policy enforcement moving to developer machines and provenance guarantees through customized images are worth tracking for supply-chain hardening plans, but no deadline or breaking change makes this actionable now.
- Leader — Skip
- Signals: deprecation mentioned (no explicit date found)
- Platform/SRE — Plan: If your org builds custom AMIs or VM images with Packer, this GA release introduces native SLSA provenance that strengthens image supply-chain attestation — worth adopting this quarter as part of a platform hardening cycle.
- CI/CD — Plan: Packer v1.16.0 adds native SLSA provenance generation to machine image builds; if your pipelines include image baking steps, schedule an update to enable provenance output and integrate verification into the release gate.
- Leader — Learn: Packer’s native SLSA provenance support signals a maturing supply-chain posture for machine images, relevant to orgs building toward SLSA compliance — no immediate strategic decision required but worth factoring into policy planning.
- Platform/SRE — Skip
- CI/CD — Learn: GitHub’s dependency graph now pulls license data from npm and PyPI registries, improving accuracy of license visibility in repos — useful context if your supply-chain compliance workflow relies on GitHub’s license detection.
- Leader — Learn: More accurate license metadata in GitHub’s dependency graph reduces the risk of unknowingly shipping components with incompatible licenses — worth noting if the org uses GitHub for license compliance reviews.
- Platform/SRE — Plan: New GA minor release of a tool platform teams operate on-cluster; appset concurrency and configurable webhook jitter are operationally relevant improvements worth scheduling an upgrade to this quarter.
- CI/CD — Plan: SLSA Level 3 provenance for all container images and CLI binaries and new Source Integrity CLI support are meaningful supply-chain hardening steps worth adopting; plan to upgrade and enable provenance verification in deployment pipelines.
- Leader — Skip
- Signals: Argo CD 3.5 supported
- Platform/SRE — Skip
- CI/CD — Learn: GitHub expanded push protection to block additional secret types and added a new scanning partner; worth reviewing if your pipelines commit credentials that may now be flagged before merge.
- Leader — Skip
- Platform/SRE — Learn: Useful framing for understanding how unsanctioned AI tools introduce new attack surfaces into the platform layer, but no specific infrastructure action or deadline is present.
- CI/CD — Learn: Directly relevant to pipeline security thinking — AI extensions and agents in the build path are an emerging supply-chain risk worth evaluating, but no concrete deprecation, compromise, or deadline anchors an Act or Plan verdict.
- Leader — Plan: Shadow AI in delivery pipelines is a policy and governance gap that warrants adding AI tool usage to supply-chain standards and acceptable-use policy; schedule a review of which AI integrations teams are using in pipelines before the next security audit cycle.
- Platform/SRE — Skip
- CI/CD — Plan: If your org uses GitHub code scanning default setup, evaluate adopting the new github-codeql-config-file repository property to standardize CodeQL scan behavior across repos without per-repo overrides.
- Leader — Plan: This enables centralized enforcement of code scanning standards across the org’s repositories — worth incorporating into the golden path or security policy for teams already on GitHub Advanced Security.
- Platform/SRE — Skip
- CI/CD — Plan: If pipelines use CodeQL for code scanning on Swift or Kotlin codebases, upgrade to 2.26.2 to gain language-version coverage for Swift 6.3.3 and Kotlin 2.4.10; no deadline, but worth scheduling this quarter.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: GitHub now holds potentially malicious workflow runs for review in public repositories; audit your org’s Actions approval settings and ensure maintainers understand how to review held runs before merging external contributions.
- Leader — Learn: GitHub’s new default protection against credential-stealing workflow attacks reduces supply-chain risk for orgs using public repos; worth noting as a positive vendor-risk signal when assessing GitHub Actions dependency.
- Platform/SRE — Skip
- CI/CD — Plan: Enable or verify Dependabot alerts are active across your repos to benefit from the expanded OpenSSF malicious-package coverage; no deadline, but this materially improves supply-chain detection in your dependency pipeline.
- Leader — Plan: Broader malware signal coverage from OpenSSF integration strengthens your software supply-chain posture — confirm Dependabot alerts are enabled org-wide as a policy standard this quarter.
- Platform/SRE — Skip
- CI/CD — Plan: GitHub now holds unproven workflows pending approval on public repos — review your repository settings and approval workflows to ensure this protection is enabled and fits your release process.
- Leader — Learn: A new GitHub platform-level control targeting supply chain attacks via compromised credentials; worth noting as a defense-in-depth signal for orgs that rely on GitHub Actions for public repositories.
- Platform/SRE — Plan: Docker removing the cost barrier for hardened, minimal base images makes it practical to standardize on them across cluster workloads, reducing CVE surface without budget justification. Evaluate adopting Docker Hardened Images as the default base-image standard in your next quarterly planning cycle.
- CI/CD — Plan: Hardened base images are directly relevant to build-time and artifact supply-chain security; with the free tier now available, it’s worth scheduling a migration of pipeline build images and application Dockerfiles to hardened variants as a supply-chain hardening step.
- Leader — Learn: Docker making a previously premium security feature free reshapes the container security tooling landscape and is useful context for evaluating whether to formalize a hardened-image standard in the golden path, but no immediate strategic decision is required.
- Platform/SRE — Skip
- CI/CD — Plan: New secret types are now auto-detected in repo scans; review your secret scanning policy to ensure newly covered credential types (Resend, APIclub) are included in alerting and rotation workflows.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: Bit-for-bit reproducible base images reduce supply-chain risk; worth following as a model if your pipelines use Arch-based images or if you’re evaluating reproducible build practices more broadly.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: Dependabot’s new default 3-day cooldown before raising version-update PRs reduces noise from yanked or quickly-patched releases; no pipeline changes required, but worth understanding if teams rely on same-day dependency PRs.
- Leader — Skip
- Platform/SRE — Learn: Grafana’s PIR confirms no customer production impact and no Grafana Cloud compromise from the TanStack npm attack; useful background on how supply chain attacks can reach observability vendors, but no operational change is required.
- CI/CD — Learn: The report details how a compromised npm package triggered a ransom incident and exposed a missed credential rotation — valuable for evaluating the depth of your own supply chain audit and rotation runbooks, even though Grafana’s customer pipelines were unaffected.
- Leader — Learn: Grafana’s independently audited transparency report (Mandiant confirmed no code tampering or repository poisoning) is useful context for assessing vendor security maturity; no strategic action is required since customer exposure was ruled out.