July 2026 - CodeRiskTools

Engineer reviewing GitHub Actions workflow triggers and permissions

GitHub Actions Self-Repository Actions: Security Review Checklist

By - CodeRiskTools Editorial
Posted on July 31, 2026
Posted in CI Security

GitHub has added a shorter way to reference an action or reusable workflow that lives in the same repository. The new self-repository syntax starts a uses: value with $/, and GitHub says it is available on github.com when the Actions runner is version 2.336.0 or newer. This is a small workflow change with a useful

Engineer reviewing GitHub Actions self-hosted runner maintenance and deployment workflow

CodeQL Action v4.37.4: Review Custom Tool Selection and Bundle Updates

By - CodeRiskTools Editorial
Posted on July 30, 2026
Posted in CI and Release Gates

A practical review checklist for CodeQL Action v4.37.4: verify repository-property tool selection, Advanced Setup precedence, the CodeQL 2.26.2 bundle, and least-privilege workflow evidence.

CodeQL 2.26.1: A Security Review Checklist for New Analysis Coverage

By - CodeRiskTools Editorial
Posted on July 29, 2026July 30, 2026
Posted in Secure Coding

Review CodeQL 2.26.1 coverage changes, compare SARIF outputs, and retest affected security paths without overclaiming static-analysis results.

GitHub Actions Workflow Approval: A Security Review Checklist

By - CodeRiskTools Editorial
Posted on July 29, 2026July 29, 2026
Posted in Secure Coding

Review GitHub Actions workflow approval holds, trigger scope, permissions, and evidence before allowing a potentially malicious run to execute.

GitHub-Hosted Runner Groups: A Security Review Checklist for Policy-Controlled CI

By - CodeRiskTools Editorial
Posted on July 28, 2026
Posted in CI and Release Gates, Secure Coding

GitHub is adding more policy control around GitHub-hosted runners, including runner groups that can direct jobs to runners meeting an organization’s requirements and the ability to disable standard hosted runners. That is useful for platform teams, but a policy setting is not the same thing as a verified security boundary. The practical question is: what

Developer reviewing security validation results for a third-party AI coding agent pull request

How to Verify a Local Vulnerability Database Before Trusting Scan Results

By - CodeRiskTools Editorial
Posted on July 27, 2026
Posted in Secure Coding

Verify the scanner artifact, signed vulnerability database, input hash, and partial-coverage limits before trusting a local vulnerability scan.

How to Scan a Local SBOM with CodeRiskTools Scanner

By - CodeRiskTools Editorial
Posted on July 27, 2026July 27, 2026
Posted in Secure Coding

Scan a local SBOM with CodeRiskTools Scanner 3.1.1, verify the signed database profile, and interpret partial coverage without overclaiming.

Engineer reviewing GitHub Issues agent automation controls and approvals

GitHub Issues Agent Automation Controls: A Review Checklist

By - CodeRiskTools Editorial
Posted on July 26, 2026
Posted in Secure Coding

Review GitHub Issues agent automation controls for rationale, confidence, approvals, permissions, and evidence before enabling public-preview workflows.

GitHub Actions Workflow Trigger Allowlists: Review Checklist for Safer Execution

By - CodeRiskTools Editorial
Posted on July 23, 2026
Posted in Secure Coding

A source-backed checklist for reviewing GitHub Actions workflow trigger allowlists, event scope, permissions, reusable workflows, and deny/allow evidence.

Engineer reviewing GitHub Actions cache keys and workflow permissions

GitHub Actions Read-Only Cache for Untrusted Triggers: A Review Checklist

By - CodeRiskTools Editorial
Posted on July 21, 2026July 21, 2026
Posted in Secure Coding

Review GitHub Actions read-only cache behavior for untrusted triggers and validate cache keys, restored paths, permissions, and execution boundaries.

Month: July 2026