A GitHub Actions expression is not a variable. It is pasted into your shell as text before bash ever sees it — and it usually lands in the one job holding your publishing credentials.
There is one line of YAML I have been chasing across open source for months:
run: |
TAG="${{ github.event.release.tag_name }}"
Enter fullscreen mode
Exit fullscreen mode
In Present Time software teams need fast, secure, and automated delivery. Earlier, release flow...
I had a GitHub Actions workflow called Deploy to DigitalOcean. It had been sitting in the repo for...
In March 2025 an attacker compromised tj-actions/changed-files and rewrote its release tags to point...
I thought that the hard part of learning CI/CD was understanding pipelines, build stages and...
You push v1.2.3 and expect a predictable sequence: tests pass → version is resolved → GitHub Release...
ActiveState explains how GitHub Actions attack chains can evade traditional CI security scanners, why passing a scan doesn't…
