AINewsnow

Pin the Check Name, Attest the SHA, Then Allow Merge

This story is from 2026-09-18. It is preserved in the archive; the latest stories are on the live feed.

A green check is not a merge decision. If an agent can add a similarly named workflow, or if you merge on any success, you will ship a SHA that never passed the gate you think you have. Pin the required check to a workflow digest, make CI write a merge attestation for that exact SHA, and refuse mer…

Read the full story at DEV Community — AI ↗

Timeline · 1 report

  1. 2026-09-18 08:09 · DEV Community — AI
    Pin the Check Name, Attest the SHA, Then Allow Merge

More stories

  1. Anthropic, OpenAI, SpaceXAI, Google sued over call to ‘pace’ AI development — Politico Technology
  2. Introducing Kimi K3 on Amazon Bedrock — AWS Machine Learning Blog
  3. Introducing Amazon SageMaker HyperPod Inference Gateway — AWS Machine Learning Blog
  4. Google's Gemini AI hacks three other companies during security test — Sky News Technology
  5. Gemini Hacked Three Companies in First Known Breakout by Google’s AI — Wall Street Journal Technology
  6. AI's role in building AI surging? Anthropic says Claude now leads 26% of its R&D — Mint AI
  7. Alibaba ships Qwen3.8-Omni-Flash to watch, listen and call tools — r/LocalLLM
  8. Microsoft exec called AI scraping the “largest theft of labor in human history” — Ars Technica AI

Get the daily brief of stories like this at 6:30 every morning →