Reading up on GitHub Actions

GitHub Actions' default features—mutable tags, pull_request_target, template injection, and write-scoped tokens—have enabled a chain of supply-chain attacks on open-source registries, and GitHub's opt-in security roadmap won't fix the root causes.

Flue is a TypeScript framework for building autonomous AI agents with a programmable harness that provides sandboxes, tools, skills, and durable execution across local and cloud runtimes.

Using skills, AGENTS.md, and GitHub Actions, OpenAI accelerated OSS maintenance in their Agents SDK repos, merging 457 PRs in three months, up from 316.

Current LLM coding agents no longer bias toward popular languages; they handle niche or new tools well via long context and documentation.

Dependabot's version-based security alerts are noisy and less effective than static analysis tools that check reachability of vulnerable functions.

Claude Code overwhelmingly builds custom solutions over recommending third-party tools, and when it picks tools, it defaults to GitHub Actions, Stripe, and shadcn/ui.

Speculation about internal tech company problems is almost always wrong because outsiders lack the insider context needed to understand the real issues.

An unclosed loop in GitHub Actions workflows caused Gemini CLI's label-adding and -removing bots to fight over 4,600 times, flooding the issue with notifications.

GitHub Actions workflows are difficult to debug when they fail inconsistently across platforms due to runner setup differences, and the author recommends keeping logic in local scripts.

GitHub backtracks on a per-minute platform fee for self-hosted Action runners after heavy backlash, while cutting hosted-runner prices by up to 39%.

Maintaining an open-source self-hosted kanban board involves relentless documentation, user support, scary database migrations, and careful scope management far beyond building the initial product.