Reading up on ci-cd

In high-growth AI startups, product designers must work inside the codebase, ship code themselves, and make incremental changes instead of relying on static blueprints.

GitHub Actions' default features—mutable tags, pull_request_target, template injection, and write-scoped tokens—have enabled a chain of supply-chain attacks on open-source registries, and GitHub's opt-in security roadmap won't fix the root causes.

An unclosed loop in GitHub Actions workflows caused Gemini CLI's label-adding and -removing bots to fight over 4,600 times, flooding the issue with notifications.

Falling costs of LLM-generated code shift software engineering bottlenecks to infrastructure, CI, human-guided abstractions, and code review in 2026.

GitHub backtracks on a per-minute platform fee for self-hosted Action runners after heavy backlash, while cutting hosted-runner prices by up to 39%.