https://www.stephane-robert.info/en/ Selected articles in English on DevSecOps, supply chain security, CI/CD and infrastructure. en Mon, 28 Sep 2026 00:00:00 GMT https://www.stephane-robert.info/favicon.svg https://www.stephane-robert.info/en/ (c) 2026 Stephane Robert contact@stephane-robert.info (Stephane Robert) contact@stephane-robert.info (Stephane Robert) 60 https://www.stephane-robert.info/en/post/actions-cool-issues-helper-compromised/ https://www.stephane-robert.info/en/post/actions-cool-issues-helper-compromised/ Every tag of actions-cool/issues-helper points to an imposter commit that drains CI/CD secrets. Detection, IOCs and defense through SHA pinning. Mon, 28 Sep 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) supply-chain github-actions alert https://www.stephane-robert.info/en/post/chainguard-actions-hardened-github-actions/ https://www.stephane-robert.info/en/post/chainguard-actions-hardened-github-actions/ Chainguard Actions rebuilds and hardens GitHub Actions from source. What it fixes, what the community pushed back on, and why a pipeline scanner still matters. Mon, 28 Sep 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) github-actions supply-chain devsecops security ci-cd https://www.stephane-robert.info/en/post/checkout-v7-blocks-pwn-requests/ https://www.stephane-robert.info/en/post/checkout-v7-blocks-pwn-requests/ actions/checkout v7 refuses fork checkouts under pull_request_target by default. What changes, the allow-unsafe-pr-checkout input, and the July 16 backport. Mon, 28 Sep 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) github-actions security devsecops supply-chain ci-cd https://www.stephane-robert.info/en/post/github-actions-15-security-pitfalls/ https://www.stephane-robert.info/en/post/github-actions-15-security-pitfalls/ 15 critical mistakes in your GitHub Actions workflows that expose secrets and code. Real 2025-2026 attacks, concrete fixes, tooling and a checklist. Mon, 28 Sep 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) github-actions security supply-chain devsecops ci-cd https://www.stephane-robert.info/en/post/github-actions-attack-infrastructure-cpanel/ https://www.stephane-robert.info/en/post/github-actions-attack-infrastructure-cpanel/ A campaign turns GitHub Actions into a distributed scanner for CVE-2026-41940 on cPanel and WHM. Installing the package runs nothing: the repo is the weapon. Mon, 28 Sep 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) github-actions supply-chain devsecops ci-cd cpanel packagist https://www.stephane-robert.info/en/post/incus-os-cluster-without-a-shell/ https://www.stephane-robert.info/en/post/incus-os-cluster-without-a-shell/ Hands-on with Incus OS, the shell-less immutable OS. A 3-node cluster built entirely through the API, the real pitfalls, and where the project stands. Mon, 28 Sep 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) incus virtualization immutable field-report https://www.stephane-robert.info/en/post/secure-software-factory-on-incus/ https://www.stephane-robert.info/en/post/secure-software-factory-on-incus/ Field report: after building an Incus private cloud, I lay out the blueprint of a multi-tenant DevSecOps software factory, and explain why not Kubernetes. Mon, 28 Sep 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) incus devsecops supply-chain private-cloud https://www.stephane-robert.info/en/post/trivy-chainguard-build-from-source-lesson/ https://www.stephane-robert.info/en/post/trivy-chainguard-build-from-source-lesson/ After the March 2026 Trivy incident, Chainguard offers 12 months of free Trivy images. The real lesson: an independent build chain limits the damage. Mon, 28 Sep 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) trivy supply-chain devsecops security github-actions https://www.stephane-robert.info/en/post/why-oidc-alone-wont-save-you-megalodon/ https://www.stephane-robert.info/en/post/why-oidc-alone-wont-save-you-megalodon/ OIDC removes static cloud credentials, not the temporary ones exposed inside the runner. Megalodon shows which layers to stack around OIDC. Mon, 28 Sep 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) github-actions oidc supply-chain devsecops https://www.stephane-robert.info/en/post/npm-no-longer-runs-install-scripts/ https://www.stephane-robert.info/en/post/npm-no-longer-runs-install-scripts/ npm v12 blocks dependency install scripts since 8 July 2026. pnpm shipped the same change in January 2025. What actually changes for your projects. Tue, 28 Jul 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) supply-chain npm devsecops security tech-watch https://www.stephane-robert.info/en/post/awx-no-release-for-two-years/ https://www.stephane-robert.info/en/post/awx-no-release-for-two-years/ AWX has shipped no release since July 2024. I scanned the official image: 45 CVEs, 3 critical. Why it happened, what I tested, and the option I settled on. Fri, 03 Jul 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) ansible awx security supply-chain devsecops https://www.stephane-robert.info/en/post/shai-hulud-npm-worm-antv/ https://www.stephane-robert.info/en/post/shai-hulud-npm-worm-antv/ On 19 May 2026 the Shai-Hulud npm worm compromised dozens of AntV packages. CI/CD secret theft, Claude Code backdoors: my analysis and how to check. Fri, 19 Jun 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) supply-chain npm devsecops security tech-watch https://www.stephane-robert.info/en/post/trivy-github-repository-wiped-by-ai-bot/ https://www.stephane-robert.info/en/post/trivy-github-repository-wiped-by-ai-bot/ The Trivy GitHub repository wiped by an autonomous AI bot: compromised PAT, every release deleted, malicious VS Code extension. Timeline and lessons. Fri, 19 Jun 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) trivy security open-source devsecops supply-chain github-actions https://www.stephane-robert.info/en/post/atomic-arch-aur-packages-hijacked/ https://www.stephane-robert.info/en/post/atomic-arch-aur-packages-hijacked/ Atomic Arch campaign: 400+ orphaned AUR packages adopted then boobytrapped (Rust stealer, eBPF rootkit). How it works and whether you are affected. Tue, 16 Jun 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) supply-chain linux alert https://www.stephane-robert.info/en/post/cra-who-is-affected/ https://www.stephane-robert.info/en/post/cra-who-is-affected/ The EU Cyber Resilience Act is not just about IoT. Find out which software, vendors, importers, distributors and open source actors are affected. Fri, 05 Jun 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) cra cyber-resilience-act supply-chain regulation devsecops https://www.stephane-robert.info/en/post/github-open-source-crisis/ https://www.stephane-robert.info/en/post/github-open-source-crisis/ GitHub stacks up an internal security breach, repeated outages and the departure of flagship projects. Is open source really in crisis? My take. Wed, 20 May 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) open-source supply-chain devsecops github sovereignty https://www.stephane-robert.info/en/post/github-actions-2026-security-roadmap/ https://www.stephane-robert.info/en/post/github-actions-2026-security-roadmap/ GitHub hardens GitHub Actions with dependency locking, execution policies, scoped secrets, Actions Data Stream and a native egress firewall. Sat, 25 Apr 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) github-actions supply-chain devsecops ci-cd security https://www.stephane-robert.info/en/post/checkmarx-kics-compromised/ https://www.stephane-robert.info/en/post/checkmarx-kics-compromised/ After Trivy, the Checkmarx/KICS incident confirms that security scanners running in CI/CD pipelines are critical dependencies to confine. Fri, 24 Apr 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) checkmarx kics supply-chain devsecops ci-cd docker github-actions https://www.stephane-robert.info/en/post/argo-cd-kyverno-gitops-policy-as-code/ https://www.stephane-robert.info/en/post/argo-cd-kyverno-gitops-policy-as-code/ Deploy Kyverno with Argo CD to enforce Kubernetes security policies in GitOps. App-of-Apps pattern, admission policies, audit vs enforce, supply chain impact. Tue, 14 Apr 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) kubernetes supply-chain devsecops security gitops https://www.stephane-robert.info/en/post/trivy-act-iv-aqua-security-response/ https://www.stephane-robert.info/en/post/trivy-act-iv-aqua-security-response/ Aqua Security published its technical analysis of the Trivy supply chain attack. Forensic tag poisoning, three-stage payload, ICP blockchain persistence. Tue, 07 Apr 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) trivy supply-chain devsecops security github-actions https://www.stephane-robert.info/en/post/kics-litellm-supply-chain-attacks/ https://www.stephane-robert.info/en/post/kics-litellm-supply-chain-attacks/ After Trivy, new compromises hit the KICS GitHub Action and LiteLLM PyPI packages. Attack vectors, malware behaviour, impact and what to do. Tue, 24 Mar 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) supply-chain github-actions pypi security open-source https://www.stephane-robert.info/en/post/trivy-compromised-second-time-poisoned-release/ https://www.stephane-robert.info/en/post/trivy-compromised-second-time-poisoned-release/ Three weeks after the initial attack, Trivy suffered a second incident: poisoned v0.69.4 release spread via Homebrew, registries and GitHub Actions. Fri, 20 Mar 2026 00:00:00 GMT contact@stephane-robert.info (Stephane Robert) trivy github-actions supply-chain devsecops security