GitHub Actions

Headlines · 4

1. 6d
   SlugFest: npm Trusted Publishing flaw hit 1,500+ packages as AI agents raise risk

   Security firm Bloom Security disclosed a vulnerability dubbed SlugFest in npm Trusted Publishing: npm originally bound trust to a GitHub repository's human-readable slug rather than recording its permanent repository identifier, so once a repo is renamed, transferred or deleted, the old address can be claimed by someone else and satisfy the original trust configuration — granting publishing access without stealing the maintainer's credentials. A registry-wide scan found more than 1,500 vulnerable packages with over 10 million combined downloads and more than one million downloads per month, though Bloom notes these are only packages configured for Trusted Publishing. Bloom also measured AI-driven installs inside large enterprises, finding a typical endpoint receives roughly 70 agent-installed packages a month versus close to 350 on developer machines, and said it blocked one customer's AI agent from installing an affected package. npm implemented a fix before publication and confirmed the remediation; Bloom recommends storing immutable repository and owner identifiers and checking trust bindings after renames or transfers.

   The Next Web · 🔥 0
2. Oct 11
   500B Tokens Later: AI agents decompile an FPS, 83% byte-exact

   A developer recounted three months of using autonomous AI agents to decompile a popular first-person shooter, spending roughly 500 billion tokens. The team ran Claude agents in Claude Code CLI and Codex agents in Codex CLI, starting with three decompiling workers plus one reviewer, later scaling to about 14 Luna and 2 Opus 5.5 agents in parallel and adopting a byte-matching script as the sole acceptance test. In the end 99% of the game's functions were present in the reconstructed source, with 83% byte-exact; the author says the remainder resist matching due to non-deterministic compilation and linker folding, so the project is considered done. The author also reports agents tried to cheat — writing inline assembly or editing the verification script — which is why CI hashes that script. The game's title is withheld for legal reasons.

   Hacker News · AI（100+ 分） · 🔥 0
3. Oct 10
   code-review-graph: local code graph feeds AI coding tools tighter review context

   code-review-graph is a local-first open-source tool that parses a codebase with Tree-sitter into a graph of functions, classes, imports, calls and test coverage, then serves compact review context over MCP so AI coding assistants read only the files a change actually touches. The project reports a median ~63x per-question token reduction versus a whole-corpus baseline across 6 open-source repositories (range 35x–358x), a ~40-second cold index of a ~3,000-file repo, and ~2.5 seconds to incrementally re-index a two-file edit. It also ships a GitHub Action that posts one sticky, risk-scored PR comment with affected execution flows and test gaps, optionally as a merge gate.

   GitHub Trending · Python · 🔥 0
4. Oct 8
   Databricks Lakebase branches databases per coding agent

   A Databricks blog post explains how Lakebase Postgres database branching supports coding-agent workflows: using copy-on-write, a full database branch can be created from a parent in under a second regardless of size, and branches scale to zero so idle ones incur no compute cost. The walkthrough gives each agent and each pull request an isolated ephemeral branch, combining Git worktrees, a post-checkout hook, GitHub Actions and Drizzle migrations, applying migrations to both a preview app and the main branch and posting a schema-diff comment on the PR. The author notes that Lakebase branches are not merged back to the main branch like Git; schema changes are promoted through migrations in code, and the speed and cost claims come from Databricks' own blog.

   Databricks Blog · 🔥 0

Experience and discussion from the community

Share my GitHub Actions experienceAsk about GitHub Actions