ci-cd
Safeguard articles tagged "ci-cd" — guides, analysis, and best practices for software supply chain and application security.
205 articles
Python Syntax Checker: Catching Errors Before They Ship
A Python syntax checker validates that your code parses and follows the rules of the language before you run it. Here are the tools that do it and how they fit a secure pipeline.
How Can a DevOps Team Take Advantage of Artificial Intelligence?
A DevOps team takes advantage of artificial intelligence by using it where signal is buried in noise — triaging alerts, prioritizing vulnerabilities, and drafting fixes. Here is where it pays off and where it does not.
How Snyk CLI's --severity-threshold and --fail-on flags g...
How Snyk CLI severity-threshold and fail-on flags filter and gate vulnerability findings, plus exit codes and common CI/CD misconfigurations.
How the Snyk CLI's exit codes are structured for CI/CD fa...
A mechanical look at how the Snyk CLI's 0/1/2/3 exit codes work, how --severity-threshold and --fail-on change them, and how to branch on them correctly in CI/CD.
Unit Testing in Node.js: A Practical, Security-Aware Setup
A working guide to unit testing in Node.js with the built-in node:test runner — structure, mocking, coverage, and the security-relevant code paths most suites forget to cover.
Megalodon: 5,561 GitHub Repos Backdoored via Injected Actions Workflows (May 2026)
In a six-hour window on May 18, 2026, an automated campaign pushed malicious GitHub Actions workflows into 5,561 repositories using credentials harvested by infostealers. We break down the attack chain, the workflow_dispatch dormancy trick, and CI detection.
Mutable Tags Strike Again: actions-cool GitHub Action Tags Redirected to Imposter Commits (May 2026)
In May 2026, every tag on actions-cool/issues-helper and 15 tags on maintain-one-comment were quietly moved to point at imposter commits that stole CI/CD credentials from runner memory. A look at the mutable-tag attack class and how to defeat it.
DevOps Metrics Tools: What to Track and How to Measure It
DevOps metrics tools collect and visualize the delivery and reliability signals that tell you whether your engineering system is actually improving. Here is what to measure and with what.
Snyk Test CLI: How to Scan Projects from the Command Line
The snyk test CLI command scans your project's dependencies for known vulnerabilities right from the terminal. Here is how to run it, gate on severity, and wire it into CI without slowing everyone down.
lint-staged (npm): A Security Review and Safe Setup Guide
The lint-staged npm package runs linters and formatters only on your git-staged files, keeping commits clean and fast. Here is how to configure it safely and what its command-running design means for security.
How to Install the Snyk CLI (npm, Homebrew, and Standalone Binary)
Step-by-step ways to install the Snyk CLI on macOS, Linux, and Windows using npm, Homebrew, Scoop, or a standalone binary, plus how to authenticate and use it in CI.
DevOps Performance Metrics That Also Measure Security
The DevOps performance metrics worth tracking are the four DORA metrics plus a handful of security signals that reveal whether speed is coming at the cost of risk.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.