GitHub Hardens npm and Actions Defaults, Drawing Debate over Delays versus Signing

Steef-Jan Wiggers — Sat, 08 Aug 2026 07:45:00 GMT

GitHub consolidated the npm and Actions changes it shipped from March to July 2026 against supply chain attacks, several of which alter defaults rather than add options. Hacker News discussion focused less on the individual controls than on whether waiting periods are the right instrument, or a substitute for author-side package signing.

By Steef-Jan Wiggers

Presentation: Rewriting All of Spotify's Code Base, All the Time

Jo Kelly-Fenton, Aleksandar Mitic — Fri, 07 Aug 2026 11:00:00 GMT

Jo Kelly-Fenton and Aleksandar Mitic explain how Spotify created "Honk," an AI coding agent, to handle complex fleet-wide codebase migrations. They share key architectural insights on decoupling CI verification runtimes from AI agents, dealing with automated pull request bottlenecks, and driving aggressive standardization across thousands of engineering repositories.

By Jo Kelly-Fenton, Aleksandar Mitic

InfoQ - Continuous Delivery

GitHub Hardens npm and Actions Defaults, Drawing Debate over Delays versus Signing

Presentation: Rewriting All of Spotify's Code Base, All the Time