Engineering guides
Backend systems, Node.js, TypeScript, AI coding, fintech infrastructure, and engineering career proof.
Back to engineering guidesLatest posts
Page 4 of 14Dependabot malware alerts: enable them and triage a real package alert
GitHub expanded Dependabot malware data beyond npm. This guide shows how to enable malware alerts, verify exposure, contain a package, and avoid unsafe auto-fixes.
npm publish-time malware scanning: fix CI that expects instant installs
npm now scans packages before making them installable. Learn how to handle the normal publishing delay, verify registry availability, and keep release jobs reliable.
TypeScript 7 upgrade guide: migrate without breaking your toolchain
A practical TypeScript 7 migration plan covering TypeScript 6 compatibility, compiler speed, editor setup, CI checks, and tools that still need the old API.
Run and clean up background services in GitHub Actions jobs
GitHub Actions background steps can be named, awaited, and cancelled while retaining separate logs. Start the service as a background step, wait for an explicit health check, run tests, and cancel it during cleanup.
Limit open pull requests from users without write access
GitHub introduced controls to limit open pull requests from users without write access. Set a reasonable limit, publish contribution guidance, and preserve a path for legitimate large efforts.
Restrict GitHub issue creation to collaborators: reduce public repository spam
GitHub added controls that can restrict issue creation to repository collaborators. Use the restriction only with a visible alternative for security reports, support, and community feedback.
Secret scanning validators for Asana, IBM, and MessageBird credentials
GitHub expanded secret-scanning validators for Asana, IBM, and MessageBird credential types. Enable validity checks, map token owners, and rotate active secrets before cleaning history.
Secret scanning public monitoring for enterprises explained
GitHub announced public monitoring capabilities for enterprise secret scanning. Define verified domains and providers, route alerts to an incident queue, and establish external-repository contact procedures.
CodeQL Kotlin 2.4 support: upgrade static analysis with the language
CodeQL 2.26 supports Kotlin versions through 2.4.0. Update CodeQL alongside Kotlin, run a full baseline, and compare extracted files and alert counts.
CodeQL support for Go slog: prevent log injection and clear-text leaks
CodeQL 2.26 adds models for Go’s `log/slog` package to improve log-injection and clear-text-logging analysis. Use stable message templates, structured attributes, secret redaction, and output encoding.
CodeQL Razor Page request sources: catch C# injection paths
CodeQL 2.26 models `OnGet`, `OnPost`, and asynchronous handler parameters as remote-flow sources for C# analysis. Update scanning and review SQL, path, command, and template sinks reached from handler values.
CodeQL SSRF checks for IPv6 transition addresses
CodeQL 2.26 includes an experimental JavaScript query for incomplete IPv6-transition SSRF guards. Parse and normalize addresses with a maintained library, then enforce destination policy after DNS resolution.
Incremental CodeQL analysis: speed up CI without missing the full baseline
GitHub announced incremental analysis improvements for Go, C/C++, and CodeQL CLI workflows. Use incremental checks for fast feedback and schedule full analysis as the authoritative baseline.
Periodic code scanning for inactive repositories: find risk without alert overload
GitHub supports periodic code scanning of inactive repositories for eligible security programs. Target repositories by deployment and dependency risk, then route findings to a real owner.
Fetch GitHub Code Quality findings through REST without building a noisy dashboard
GitHub exposes Code Quality findings through REST for integrations and reporting. Import only findings tied to a clear workflow, deduplicate by stable identity, and sync resolution state.
Self-service credential revocation in GitHub incident response
GitHub added self-service credential revocation capabilities for supported enterprise incident workflows. Define who can revoke, how identity is verified, and how affected automation receives replacement credentials.
GitHub security API access restrictions: audit integrations before retirement
GitHub announced upcoming restrictions to public security API endpoints and related views. List every integration, owner, credential, endpoint, and fallback before enforcement.
GitHub closed security alert retention: export what compliance needs
GitHub announced an upcoming data-retention policy for closed security alerts. Identify audit requirements, export permitted records, and avoid storing sensitive alert details longer than necessary.
GitHub code coverage merge protection: prevent untested changes carefully
GitHub announced code coverage merge protection for pull requests. Baseline by repository, focus on changed code, and provide reviewed exceptions.
GitHub Actions 50-rerun limit: fix flaky workflows instead of retrying forever
GitHub limits a workflow run to 50 reruns, including full and partial reruns. Classify failures, use bounded retries around known transient operations, and repair deterministic flakes.
GitHub App token format changes: stop validating opaque tokens with regex
GitHub is rolling out a new installation-token format and recommends storage supporting at least 520 characters. Treat tokens as opaque, widen database columns, and test logs, proxies, and validators.
GitHub release asset download counts: interpret adoption without bad conclusions
GitHub now shows per-asset download counts in the Releases UI for users with write access; source archives are not included. Compare assets by platform and version while labeling bots, retries, and missing archive downloads as limitations.
Test GitHub Actions on Ubuntu 26.04 and Windows 11 ARM64 runners
GitHub provides Ubuntu 26.04 x64 and ARM64 plus Windows 11 ARM64 with Visual Studio 2026 in public preview. Add non-blocking matrix jobs first and compare tool versions and artifacts.
Approve bot-created pull requests before running GitHub Actions
Pull requests created by `github-actions[bot]` can run workflows after approval by a user with write access. Require approval for generated code and keep privileged jobs behind stronger environment gates.
GitHub self-hosted runner minimum versions: avoid queued jobs and brownouts
GitHub requires registration on runner 2.329.0 or newer and ongoing updates within 30 days, with enforcement timelines in 2026. Inventory runner versions, update images and bootstrap scripts, and monitor brownout annotations.
actions/checkout v7 blocks pwn requests: migration checklist
actions/checkout v7 refuses common unsafe fork checkout patterns and GitHub plans enforcement across supported majors. Replace privileged checkout-and-run workflows with unprivileged analysis or a reviewed two-stage design.
Control GitHub Actions workflow triggers with organization rulesets
Workflow execution protections add actor and event allowlists through GitHub rulesets. Run rules in evaluate mode, identify legitimate triggers, then block risky actors and events centrally.
Read-only GitHub Actions cache for untrusted triggers explained
GitHub now issues read-only cache tokens in default-branch contexts triggered by actors without write permission. Move cache population to trusted push or scheduled workflows and let untrusted runs restore only.
Parallel steps in GitHub Actions: use background, wait, and cancel correctly
GitHub Actions adds `background`, `wait`, `wait-all`, `cancel`, and `parallel` workflow controls with separate logs. Parallelize only independent work and name every background step that later steps depend on.
Node.js 26 upgrade rollback plan for APIs and workers
Node.js 26 includes engine, HTTP, API, and removal changes that can affect several application layers. Pin the old image, canary one service, compare telemetry, and make schema changes backward compatible.