GitHub Actions change will silence workflows in 27% of top 1,000 starred repos by November

·22 views

GitHub is rolling out two breaking changes to its pull_request_target workflow trigger, with a key deadline of November 2, 2026, when the trigger will be blocked on public repositories lacking an explicit Actions policy. A scan of the 1,000 most-starred public GitHub repositories, conducted on September 26, 2026, found that 269 of them run at least one workflow on pull_request_target, meaning those workflows will stop executing unless maintainers update their policies. Since July 20, 2026, the actions/checkout action already refuses to check out fork pull request code in privileged workflows unless opted in, causing step failures in at least nine repositories. Three repositories were found using an older pinned version of actions/checkout that bypasses the new guard entirely, leaving fork code accessible alongside workflow tokens and secrets — identified as the most urgent security risk. A free open-source tool called prt-check was developed to help repository maintainers audit their own workflows for these issues in a single step.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Custom Booking Platform or Off-the-Shelf Software? A Guide for Service Businesses

This guide helps service businesses decide between custom booking software and ready-made tools by weighing cost, fit, data ownership and growth. It recommends first mapping the current booking flow to find where work piles up. Standard off-the-shelf tools are presented as the better choice for typical flows because of their speed, lower price and easier maintenance. A custom platform is justified when unique business rules cause manual work, double bookings or lost jobs. The article also urges checking data export rights and who can maintain the system if the builder leaves.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Compare Cybersecurity Courses Before You Enrol

Choosing a cybersecurity course can be difficult for beginners, since many programs cover similar topics and advertise comparable tools. The article argues that price and promotional claims are not reliable guides, and that learners should check whether a course matches their goals. It recommends reviewing the syllabus for a logical progression through foundational subjects such as networking, operating systems, scripting and web security. Prospective students should also look for hands-on practice in authorised lab environments and assess trainer quality, course duration and pacing. Finally, it cautions that certificates alone should not determine a choice, since employers typically look for demonstrated understanding and applied skills.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

REST, GraphQL or gRPC: A Quick Guide to Choosing an API Style

Many teams pick an API style based on past experience, which can lock them into a choice for years. The article argues the decision can be made quickly by answering three questions about your system. Who calls the API, how varied the clients' data needs are, and how much inter-service speed matters. Public-facing APIs point toward REST for its broad tooling and HTTP caching, while internal, performance-sensitive services suit gRPC. Multiple clients with differing data requirements make GraphQL worthwhile despite its added complexity.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to set Claude Code's base URL for a relay and verify the relay really serves Claude

The article explains how Claude Code uses the ANTHROPIC_BASE_URL variable to redirect API traffic through a proxy, and how ANTHROPIC_AUTH_TOKEN and ANTHROPIC_API_KEY set the credential header. It notes that some providers route Claude Code to non-Claude models via the same mechanism, which Anthropic does not support through gateways. To check a relay, the author recommends behavioral tests rather than asking the model its identity, such as a Python tool called claude-relay-check that tests response format, prompt caching, and thinking-block signatures. A second tool, ModelTrace, estimates the model family from generated digit distributions but is described as only a hint. The piece is written by the operator of a relay, which the author discloses.

0 comments Read more at DEV Community