Standard.site Docusaurus with Sequoia

Securing CI/CD for an open source project, part 3: Credentials, verification, and what’s next

Bài viết thứ ba trong loạt bài tăng cường CI/CD của Cilium tập trung vào cô lập credential, ký ảnh (image signing) và xác thực chuỗi cung ứng, bao gồm sử dụng Sigstore Cosign, SPDX SBOMs, DCO sign-offs, cũng như liệt kê những hạn chế còn tồn tại như thiếu SLSA provenance hay govulncheck. Ngoài ra, bài viết còn đối chiếu lộ trình bảo mật 2026 của GitHub Actions với các biện pháp hiện tại và kế hoạch tương lai của Cilium.

Lập trình viên cần đọc bài này để hiểu cách bảo mật hóa chi tiết cho quy trình CI/CD của dự án mở nguồn, từ cách quản lý mật khẩu an toàn đến việc xác thực và triển khai các giải pháp hiện đại như OIDC và SBOM, giúp tránh rủi ro từ các lỗ hổng trong chuỗi cung ứng.

Mastering Secure CI/CD for ECS with GitHub Actions

Bài viết hướng dẫn xây dựng quy trình CI/CD an toàn cho ECS trên Fargate bằng GitHub Actions, bao gồm tối ưu vận hành (gộp workflow, dùng commit hash cho tag image, quản lý task definitions/services bằng ecspresso) và nâng cao bảo mật (AssumeRole không khóa tĩnh qua OIDC, quét lỗ hổng với Trivy/Dockle, multi-stage build giảm bề mặt tấn công).

Lập trình viên cần đọc bài này để học cách xây dựng và tối ưu hóa chuỗi tích hợp liên tục (CI/CD) cho AWS ECS trên Fargate với GitHub Actions, từ đó nâng cao bảo mật, giảm rủi ro và tiết kiệm chi phí trong việc triển khai ứng dụng.

StepSecurity Maintained Actions Are Now Free for Public Repos

StepSecurity is making its catalog of 500 Maintained Actions free for all public repositories on GitHub. These are secure, drop-in replacements for popular third-party GitHub Actions that are abandoned, under-maintained, or carry security risks. Each action undergoes manual code review, AI-assisted security analysis, signed commits, tag protection, and proactive vulnerability patching with defined SLAs. The announcement follows the March 2025 tj-actions/changed-files supply chain attack (CVE-2025-30066), which compromised over 23,000 repositories. Switching requires only a one-line YAML change, and enterprise customers can automate bulk replacements via Policy-Driven PRs.

Build raises $8.5M to automate data-centre due diligence

Build, a British-founded startup, has raised $8.5M in seed funding led by Index Ventures to automate data-centre and infrastructure due diligence using AI. The platform pulls from over 1,600 data sources to assess planning, power, and political risks in parallel, cutting due-diligence timelines by 95%. Unlike typical AI startups, Build sells the completed work on a monthly retainer rather than software licences, positioning itself as a consultant replacement. Founded in 2024 by architect-turned-coder James Stirrat-Ellis and AI researcher Ben McClusky, the company has already completed 100+ projects across 15 countries and recently landed its first hyperscaler client. Notable angels include OpenAI CFO Sarah Friar and Blackstone CTO John Stecher.

Marc Andreessen joins the Pentagon’s board, and the old line blurs

Marc Andreessen has been appointed to the Pentagon's Defense Policy Board, an advisory body that shapes military procurement and technology strategy. His firm, Andreessen Horowitz, holds major stakes in defense-tech companies including Anduril, Skydio, Shield AI, and others whose fortunes depend directly on Pentagon decisions. The financial disclosure form for board members in his category is confidential, meaning the public cannot independently assess the overlap between his advisory role and his investment portfolio. The piece examines the conflict-of-interest framework that governs such appointments, noting it relies heavily on self-policing, and situates Andreessen's appointment within a broader trend of Silicon Valley investors and allies taking federal advisory and agency roles. It acknowledges the genuine argument that tech-savvy advisers could modernize Pentagon procurement, while questioning whether sealed disclosures and good-faith assurances are sufficient safeguards given the financial stakes involved.

Nvidia competitor Etched hits $5B valuation, $1B in sales for AI chip

AI chip startup Etched has emerged from stealth with $1 billion in contract orders for its inference-focused chip systems, a $5 billion valuation, and $800 million raised to date. Founded in 2022 by Harvard dropouts Gavin Uberti and Robert Wachen, the company builds 'frontier inference clusters' — full systems combining custom chips, racks, and software designed to run AI inference faster and more cheaply than GPU-based alternatives. TSMC successfully manufactured the chip earlier this year and customer testing is underway. Notable backers include Jane Street, Two Sigma, Andrej Karpathy, Geoffrey Hinton, and Peter Thiel. The announcement comes amid a broader AI chip investment boom, with competitors Cerebras completing an IPO and Groq raising $650 million.

Secure Registry now tells you which machine pulled a compromised package

StepSecurity's Secure Registry has added source attribution to its audit log, allowing security teams to identify exactly which developer machines or CI pipelines pulled a compromised npm or PyPI package. The feature adds two new columns — Source and Source Identifier — to the Policy Evaluations log, linking each request to a specific device or GitHub Actions workflow run. Triggered by real incidents like the Mastra npm supply chain attack (June 17, 2026) and two compromised GitHub Actions (June 24), the feature enables teams to scope blast radius in minutes rather than hours. Attribution is opt-in and requires appending an identifier suffix to registry auth tokens.