GitHub Actions
Browse all articles, tutorials, and guides about GitHub Actions
Posts
GitHub Actions Removed Node 20. Find Every node20 Action You Still Run
Since September 23, GitHub Actions runs every node20 action on Node 24, and the opt-out is gone. An action that still works only adds a warning, so they are easy to miss until one breaks. Here is how to list every action your workflows use, read its runs.using value, and catch the ones hidden behind SHA pins and composite actions.
GitHub Started Enforcing Self-Hosted Runner Versions. We Tested What Happens
GitHub started enforcing self-hosted runner versions on September 29. We tried four runner versions against a free github.com organization and asked GitHub's own API about every release. One was refused, one connected and then exited while its job waited in the queue, and the API scheduled every version's end about nine weeks after its successor.
CI Passed 6 of 6 Migrations. A Neon Branch of Production Passed 1
How to test Postgres migrations before production: branch production on Neon in seconds, run each migration while an app keeps reading and writing, and gate on errors, failed queries, lock stalls and lost rows. The six migrations that passed on our fixture database failed five times on the branch.
Gate Your Terraform Plans: Rules Decide, the Model Explains
A pull request says "3 to add, 1 to change, 1 to destroy" and everyone approves it. This is a GitHub Action that reads the plan JSON, fails the job on selected changes that risk data loss or public exposure, and uses DigitalOcean inference only to write the comment. Measured against twenty labelled plans, including the four it misses.
What Does One Merge Actually Cost You in CI?
Wall-clock time and machine minutes are different numbers, and most teams track only one. Here is how to get both from your own repo.
Explaining CI Failures Automatically with a GitHub Action
We built a GitHub Action that reads a failing job log and tells you what broke, using DigitalOcean serverless inference. The interesting part was not the model call. It was throwing away 92% of the log before sending it.
The pwn request just got harder: what actions/checkout v7 changes, and what it does not
GitHub is backporting a fork-checkout block to actions/checkout, with enforcement on July 20, 2026. Here is what a pwn request actually is, what the change stops, and the three ways your pipeline is still exposed after you upgrade.
When the Malicious Hook Is in the Other Manifest: 700+ Repos, 8 Packagist Packages, One package.json Trick
On May 22, 2026, Socket disclosed a Composer supply chain attack that hid an npm-style postinstall command inside package.json on PHP projects. composer.json was clean, the PHP review missed it, and 700+ GitHub repos pulled it in. Here is the exact payload, why ecosystem-boundary blindness keeps catching teams, and how to wire your CI to look at both manifests.
TanStack npm Worm: The Supply-Chain Attack With a Dead-Man's Switch
On May 11, 2026, attackers republished 14+ official TanStack packages on npm with a worm that signs itself with valid SLSA provenance and arms a dead-man's switch that wipes your home directory the moment you revoke the stolen GitHub token. Here is what happened, how the payload works, and how to check your machine.
GitOps: Deploy Docker Containers with GitHub Actions and ArgoCD
Learn how to implement a modern GitOps workflow for Docker deployments. This guide covers building images with GitHub Actions, pushing to container registries, and automated deployments with ArgoCD.
The GitHub Actions Workflow That Eliminated Our DevOps Bottleneck
How we reduced deployment time from 2 hours to 8 minutes using smart GitHub Actions patterns and parallel execution strategies.