Preventing Secret Leaks in GitHub Actions Logs and Moving to OIDC Authentication

·1 views

Following a prior incident, the author argues that after rotating keys, teams must also stop them from leaking again, since CI pipelines are a common leak point. The article identifies three frequent problems: echoing secrets directly in run steps, where GitHub's log masking is only best-effort, exposing secrets through workflow-level env that every job and third-party action can read, and relying on long-lived cloud keys. Recommended fixes include passing secrets through step-scoped environment variables, explicitly masking derived values, and switching to short-lived OIDC credentials for AWS, GCP, and Azure with tightly restricted trust policies. The author also introduced actions-harden, a tool that flags these risky patterns in workflow files.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Frameworks or Libraries? How Solo Developers Can Choose the Right JavaScript Tool

Solo tech founders often struggle with scalability and resource limits, making the choice between JavaScript frameworks and libraries a critical early decision. Frameworks such as React, Angular, and Vue.js provide built-in structure and speed up launches, but they carry a steeper learning curve and risk lock-in. Libraries offer greater architectural freedom and lighter footprints, though they require more upfront planning and integration effort. The article illustrates trade-offs through examples like real-time financial dashboards and social analytics tools, noting where Angular's data binding or React's component model may fit. It concludes that the right choice depends on how well the tool's philosophy aligns with the project's operational strategy.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds tool that logs bug fixes and flags repeated mistakes before commit

The author notes that the same credential-leak bug in the Python requests library was fixed in 2014 and again in 2023, because the lesson was buried in git history. Similar redirect-credential bugs have been fixed at least 47 times across 22 projects since 2014. To counter this, the author built Bug Diary, a local tool that automatically writes post-mortems for fix commits using Gemma 4 and checks new changes against past lessons. It runs entirely on a laptop with Ollama and a SQLite file, and a demo shows it catching a repeated race condition in a separate project's token refresh code.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Orquesta Commits Every AI Agent Action to Git for Full Traceability

The developers of Orquesta argue that AI agents modifying a codebase should be held to the same traceability standards as human developers. Their platform records each discrete agent action, such as a file edit, shell command, or test fix, as a separate git commit with its own diff, timestamp, and message. The agent works on dedicated branches under its own git identity, so changes can be distinguished from human work. The authors contrast this with tools that either leave AI edits uncommitted or bundle a whole session into one opaque commit, which makes review and selective rollback difficult. Granular commits, they say, let teams see exactly what changed, when, and why, and revert only the problematic step.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Agent Ran Approved Command 40 Minutes After Sign-Off, Prompting Time-Limited Lease Tool

A developer who uses coding agents on a propose-approve-execute workflow found that a command they approved at 10:00 was run at 10:40, after the approval had gone stale. In response, they built leaseguard, a single-file, zero-dependency Node 18+ tool that turns an approval into a time-limited grant tied to a specific command and note. Before execution, the gate checks the lease and a standing deny policy, which takes precedence over any valid lease. The tool also keeps an audit log of what ran and what was denied. The author notes it is not designed to stop a determined adversary with access to the local file system.

0 comments Read more at DEV Community