Article URL: https://github.blog/security/supply-chain-security/disrupting-supply-chain-attacks-on-npm-and-github-actions/ Comments URL: https://news.ycombinator.com/item?id=490964…

New to GitHub? This beginner’s guide explains version control, repositories, and pull requests—plus everything else you need to start working confidently on GitHub. How to build the “Trust Layer” for GitHub Copilot cloud agent without brittle scripts or black-box judgements by using dominatory analysis. A new default three-day cooldown delays version update pull requests so maintainers and security researchers can address findings in a release before it gets into your code. GitHub is making some significant changes to its bug bounty program, shifting its focus to give researchers a better experience working with the GitHub team. GitHub had over 14,000 repositories. Fewer than half had clear ownership. Here’s how we gave every active repository a validated owner in under 45 days, archived the rest, and made ownership the foundation for everything that followed.