How to Turn a Postman Collection into a GitHub Actions CI Pipeline

·3 views

Developers can automate API testing by exporting a Postman collection and wiring it into a GitHub Actions workflow using Newman, the command-line runner. The setup requires committing the exported collection and environment files to the repository alongside a YAML workflow file of roughly 30 lines. Sensitive credentials such as API tokens must be stored in GitHub's encrypted secrets store and injected at runtime via environment variables, never hardcoded into files. Newman automatically returns a non-zero exit code on test failure, which causes the Actions workflow to fail and can block pull request merges when branch protection rules are enabled. An HTML report is generated after each run and uploaded as an artifact, with the 'if: always()' condition ensuring the report is preserved even when tests fail.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

New AWS S3 Annotations Feature Has a Security Gap That Bypasses Integrity Checks

A security researcher demonstrated that AWS S3's newly launched annotations feature, released in June 2026, can be exploited to alter a file's metadata context without modifying the file itself. In a proof-of-concept, a HIPAA-regulated health record stored in S3 had its security label changed to 'public' purely by editing its annotation, leaving the file's checksum completely unchanged. Standard integrity monitors scanning the storage bucket detected no tampering, since the underlying object was never touched. The vulnerability stems from annotations being independently writable and mutable, meaning permission to edit context metadata is a separate, potentially overlooked access control. The researcher argues this creates a significant blind spot in data classification pipelines built on top of the new feature, which supports up to 1 GB of structured metadata per object and is queryable via Amazon Athena.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds self-hosted AI agent runtime to keep execution off third-party clouds

A developer has launched VaultRun, an open-source, self-hosted runtime designed to give engineers direct control over where AI agents execute code. The project was motivated by concerns that hosted sandboxes are unsuitable when agents handle credentials, customer data, or production infrastructure. VaultRun runs each agent session in an isolated Docker container with network access disabled by default, requiring explicit permission grants for any connectivity. It also logs agent actions in a signed audit trail, allowing teams to reconstruct exactly what commands were run, when, and with what results. Released under the Apache 2.0 license, the project is in early development and available on GitHub, with the creator inviting feedback from developers navigating similar security tradeoffs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Java 21 Virtual Threads Boost Concurrency but Can Overwhelm Database Connection Pools

Java 21 introduced virtual threads via Project Loom, allowing applications to handle tens of thousands of simultaneous requests without manual thread-pool tuning. However, this surge in concurrency can expose a hidden bottleneck: fixed-size database connection pools such as HikariCP, which were originally sized for lower concurrency levels. When thousands of virtual threads compete for a pool of only a few dozen connections, requests queue up and time out, shifting the crash from the compute layer to the data layer. Previously, platform threads inadvertently capped concurrency and acted as an unintentional safeguard for downstream resources. Developers adopting virtual threads are advised to reassess and right-size their connection pools based on what the database can actually sustain, not merely what the application demands.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Stripe Acquires AI Model Router OpenRouter for Over $7 Billion

Payments giant Stripe has finalized a deal to acquire OpenRouter, an AI model routing platform, for more than $7 billion, Bloomberg reported on August 16. Founded in 2023 by Alex Atallah, OpenRouter provides a single API giving developers access to over 400 AI models from providers including OpenAI, Anthropic, and Google, charging a 5% fee on inference spend. The acquisition price represents more than five times OpenRouter's $1.3 billion Series B valuation, which was set just 82 days earlier in late May 2026. Stripe and OpenRouter had already been working closely together since January 2026, when OpenRouter adopted Stripe's invoicing, tax, and fraud tools to manage its global billing. Analysts see the deal as a logical extension of Stripe's core expertise in routing high-volume, latency-sensitive transactions across multiple providers — a structure closely mirrored by AI inference routing.

0 comments Read more at DEV Community