Daily Edition · Page 2

THE DAILY INDEX

Technology, AI, software, security, crypto and business

PROGRAMMING, DESIGN & DATA SCIENCE

TLDR

WHOSE CODE AM I RUNNING IN GITHUB ACTIONS?

Somebody added malicious code to the tj-actions/changed-files GitHub Action a week ago, making the compromised action leak secrets to build logs. The attack was possible because it's common practice to refer to tags in a GitHub Actions workflow - changing a tag can make an action run different code the next time it runs. Specifying a git commit ID instead creates a reference that will run the same code every time. This post presents a script that enables you to check whether there are any mutable references within your GitHub Actions workflows.

4-DAY WORK-WEEK PILOT DUE IN TECH LAND BY EARLY SUMMER

The 4 Day Week Foundation is urging tech businesses to sign up for a six-month trial from June 30 in the UK. There will be a six-week workshop and training that starts on May 22. Hundreds of British companies have already shown that a four-day, 32-hour working week with no loss of pay can be a win-win for workers and employers. The results of the upcoming pilot will be reviewed by researchers at the University of Sussex and Newcastle University.

TLDR IndexPage 2