Securing Github Actions With William Woodruff

Summary

Your DevOps team already set up the pipelines. But the custom workflow or PR bot you just added? That YAML is yours, and so ... ABSTRACT & BIO ▭▭▭▭▭▭ In the world of Continuous Integration and Continuous Deployment, A storage key ends up in Pinecone's build log. This episode puts secrets where they belong and adds the scanners that catch the ... Master software composition analysis in VS Code to When working in the real world with continuous integration / continuous deployment, you have to take care of your pipelines and ... Last video, we found an API key typed straight into the workflow file. Anyone who can read the repo can read it, and This talk will provide a developer-minded introduction to "trusted publishing," an OpenID Connect-based authentication scheme ... End-to-end signing and verification is one of the hardest technical and social challenges in open source packaging: it rests at the ... Igor Stepansky shows how attackers abuse I made this thing a few years ago and found it again while cleaning out my home directory. I made a neat little scanner and web ...