.tip

Jul 17, 2026 · one of the small things

Pin GitHub Actions by commit digest, not tag

A tag can be moved. The March CI campaign force-pushed tags on a popular action and every workflow that trusted @v1 ran the new code. A digest cannot be moved.

uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0

Dependabot and Renovate keep the digest current and the comment readable.

securityci

~/tips/today — 2026-09-04

~cat tips/today

Session cookies: HttpOnly, Secure, SameSite=Lax

securityhttp

Three attributes, each closing a class of attack. HttpOnly keeps scripts from reading it. Secure keeps it off plain HTTP. SameSite=Lax stops it being sent on cross-site POSTs, which is most CSRF.

Set-Cookie: session=...; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=1209600

Strict breaks arriving from an external link while logged in. Lax is the default worth keeping.

↵ open y yesterday l ls /tips

esc close