Achieving SLSA 3 Compliance with GitHub Actions and Sigstore for Go modules
Learn how to build packages with SLSA 3 provenance using GitHub Actions.
Jose Palafox
April 7, 2022
Learn how to build packages with SLSA 3 provenance using GitHub Actions.
In March, we experienced several incidents resulting in significant impact to multiple GitHub services.
The new dependency review action and API prevents the introduction of known supply chain vulnerabilities into your code.
We want to take away the pain and effort of keeping your code secure, so check out how Dependabot empowers developers to keep to their projects secure.
From automating builds and releases to taking care of large-scale regression testing, here are a few ways we use GitHub Actions to build GitHub.
Organizations with GitHub Advanced Security can now proactively protect against secret leaks with secret scanning’s new push protection feature.
We’re releasing exciting improvements that will streamline your Codespaces experience when working with multi-repository projects and monorepos.
Introducing CodeQL packs to help you codify and share your knowledge of vulnerabilities.
On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm. Read on to learn more about the impact to GitHub, npm, and our users.
Today, we're shipping a new feature for Dependabot alerts which helps you better understand how you're affected by a vulnerability.
We’re releasing exciting improvements that will streamline your Codespaces experience when working with multi-repository projects and monorepos.
Introducing CodeQL packs to help you codify and share your knowledge of vulnerabilities.
Another new release of Git is here! Take a look at some of our highlights on what's new in Git 2.36.
Upgrade your local installation of Git, especially if you are using Git for Windows, or you use Git on a multi-user machine.
Today, we’re excited to bring you a few new features that will help you communicate, collaborate, and connect seamlessly with teams and communities about the software you’re building with the help of GitHub Discussions.
Each month, we highlight open source projects that have shipped major updates. These include everything from world-changing technology to developer tooling, and weekend projects. Here are our top staff picks…
Advice on fundamentals, picking languages to learn, social media presence, interviewing, and more
Today, we are rolling out a new beta version of GitHub’s home feed, making it easier to discover projects, developers and more across GitHub.
Another new release of Git is here! Take a look at some of our highlights on what's new in Git 2.36.
Upgrade your local installation of Git, especially if you are using Git for Windows, or you use Git on a multi-user machine.
On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm. Read on to learn more about the impact to GitHub, npm, and our users.
As the global response to the tragedies in Ukraine and other impacted regions continues to evolve, I wanted to share with our community an expansion of the message that I shared earlier this week with our Hubbers.
We’re changing which keys are supported in SSH and removing unencrypted Git protocol. Only users connecting via SSH or git:// will be affected. If your Git remotes start with https://, nothing in this post will affect you. If you’re an SSH user, read on for the details and timeline.
Introducing CodeQL packs to help you codify and share your knowledge of vulnerabilities.
Today, we're shipping a new feature for Dependabot alerts which helps you better understand how you're affected by a vulnerability.
Today, we’re excited to bring you a few new features that will help you communicate, collaborate, and connect seamlessly with teams and communities about the software you’re building with the help of GitHub Discussions.
The new dependency review action and API prevents the introduction of known supply chain vulnerabilities into your code.
We want to take away the pain and effort of keeping your code secure, so check out how Dependabot empowers developers to keep to their projects secure.
From automating builds and releases to taking care of large-scale regression testing, here are a few ways we use GitHub Actions to build GitHub.
GitHub Copilot is now available from Visual Studio 2022 for everyone in the technical preview.
Securing your projects is no easy task, but end-to-end supply chain security is more top of mind than ever. We've…
Introducing CodeQL packs to help you codify and share your knowledge of vulnerabilities.
On April 12, GitHub Security began an investigation that uncovered evidence that an attacker abused stolen OAuth user tokens issued to two third-party OAuth integrators, Heroku and Travis-CI, to download data from dozens of organizations, including npm. Read on to learn more about the impact to GitHub, npm, and our users.
Today, we're shipping a new feature for Dependabot alerts which helps you better understand how you're affected by a vulnerability.
Upgrade your local installation of Git, especially if you are using Git for Windows, or you use Git on a multi-user machine.
Learn how to build packages with SLSA 3 provenance using GitHub Actions.
The new dependency review action and API prevents the introduction of known supply chain vulnerabilities into your code.
We want to take away the pain and effort of keeping your code secure, so check out how Dependabot empowers developers to keep to their projects secure.
Another new release of Git is here! Take a look at some of our highlights on what's new in Git 2.36.
Today, we're shipping a new feature for Dependabot alerts which helps you better understand how you're affected by a vulnerability.
How we sped up GitHub.com by moving slow, non-critical code into rack.after_reply.
Each month, we highlight open source projects that have shipped major updates. These include everything from world-changing technology to developer tooling, and weekend projects. Here are our top staff picks…
Today, we are rolling out a new beta version of GitHub’s home feed, making it easier to discover projects, developers and more across GitHub.
In March, we experienced several incidents resulting in significant impact to multiple GitHub services.
Organizations with GitHub Advanced Security can now proactively protect against secret leaks with secret scanning’s new push protection feature.
You can now enforce consistent usage of self-hosted runner groups across your organization and enterprise.
Advice on fundamentals, picking languages to learn, social media presence, interviewing, and more
GitHub Education is fired up for the return of .Tech Domains developer community competition: Break The Code 2. We've hacked in some new enigmas, cheat codes, and easter eggs for digital sleuths to uncover!
The MLH Fellowship, powered by GitHub, is a 12-week internship alternative for aspiring software engineers. Meet the 2022 cohort!
As the global response to the tragedies in Ukraine and other impacted regions continues to evolve, I wanted to share with our community an expansion of the message that I shared earlier this week with our Hubbers.
In GitHub's latest transparency report, we’re giving you a by-the-numbers look at how we responded to requests for user info and content removal.
When digital infrastructure is overlooked by governments, it isn't just a missed opportunity: policies may inadvertently endanger open source collaboration.
Upgrade your local installation of Git, especially if you are using Git for Windows, or you use Git on a multi-user machine.
From automating builds and releases to taking care of large-scale regression testing, here are a few ways we use GitHub Actions to build GitHub.
As the global response to the tragedies in Ukraine and other impacted regions continues to evolve, I wanted to share with our community an expansion of the message that I shared earlier this week with our Hubbers.