Tessera
Folgen

Shunsuke Suzuki

@seli07.bsky.social

Software Engineer (Platform Engineer) OSS Developer https://github.com/suzuki-shunsuke https://twitter.com/szkdash

140 Posts65 Follower6 Folgt
Shunsuke Suzuki@seli07.bsky.social · last wk.

pinact v5 is out 🎉 pinact is now AI-friendly: - Agent Skill - pinact docs - pinact json-schema Agents can get the exact documentation matching the installed version of pinact from these commands — without network access. github.com/suzuki-shuns...

Release v5.0.0 · suzuki-shunsuke/pinact

v4.1.1...v5.0.0 Upgrade Guide 🤖 pinact is now AI friendly v5 is about coding agents. An agent that is asked about pinact, or that hits a pinact error in CI, has until now had to answer from its tra...

github.com

Shunsuke Suzuki@seli07.bsky.social · last wk.

🚀 I've released a GitHub Action to create a GitHub App installation access token, signing JWTs with AWS KMS. It can directly assume an IAM Role via OIDC. It avoids exposing GitHub App private keys and AWS credentials. github.com/suzuki-shuns...

GitHub - suzuki-shunsuke/create-github-app-token-aws-kms: GitHub Action to create a GitHub App installation access token, signing the JSON Web Token with AWS KMS

GitHub Action to create a GitHub App installation access token, signing the JSON Web Token with AWS KMS - suzuki-shunsuke/create-github-app-token-aws-kms

github.com

Shunsuke Suzuki@seli07.bsky.social · last mo.

ghtkn v0.4.0 is out 🎉 This includes breaking changes. The device flow is now started only by ghtkn auth for security. urfave/cli was replaced with Cobra to fix bugs. Coding agents can read the config schema with the new json-schema command. github.com/suzuki-shuns...

Release v0.4.0 · suzuki-shunsuke/ghtkn

v0.3.6...v0.4.0 ⚠️ Breaking Changes #580 Replace urfave/cli with cobra #583 Remove the -d option and GHTKN_ENABLE_DEVICE_FLOW Long flags require two dashes. -config, -log-level, -min-expiration, -...

github.com

Shunsuke Suzuki@seli07.bsky.social · last mo.

Thanks for sharing this article! This is exactly the kind of real-world problem ghtkn is meant to solve. ghtkn uses short-lived GitHub App User Access Tokens and refresh tokens, and its agent backend can encrypt credentials without relying on a system keyring.

Aki Ariga@chezo.uno · last mo.

Learned that `gh auth login` saves the OAuth token in plaintext on WSL, and that malware actively hunts for hosts.yml. Thanks to @seli07.bsky.social , here's what I did to improve the situation: chezo.uno/blog/2026-08...

Shunsuke Suzuki@seli07.bsky.social · last yr.

Securefix Action v0.2.0 🎉 You can now change the repository and branch where a commit is pushed. You can also create pull requests. You can replace insecure commit and pr generation with Securefix Action, elevating the security to the next level. github.com/csm-actions/...

Release v0.2.0 · csm-actions/securefix-action

Issues | Pull Requests | v0.1.0...v0.2.0 | Base revision Overview Breaking Changes #164 The process label deletion was moved from the client side to the server side Features #123 Support pushi...

github.com

Shunsuke Suzuki@seli07.bsky.social · last yr.

I've released a new GitHub Action to validate pull request reviews. It enforces the requirement for reviews and prevents pull requests from being merged without proper review. github.com/suzuki-shuns...

GitHub - suzuki-shunsuke/validate-pr-review-action: GitHub Action to validate pull request reviews

GitHub Action to validate pull request reviews. Contribute to suzuki-shunsuke/validate-pr-review-action development by creating an account on GitHub.

github.com

Shunsuke Suzuki@seli07.bsky.social · last yr.

cmdx v2.0.0 is out 🎉 - The default shell is changed from sh to `bash -euo pipefail`. If bash isn't available, sh is used. - The format of pre-built binaries for Windows is changed from tar.gz to zip github.com/suzuki-shuns...

Release v2.0.0 · suzuki-shunsuke/cmdx

Pull Requests | Issues | v1.7.7...v2.0.0 ⚠️ Breaking Changes The default shell is changed from sh to bash -euo pipefail. If bash isn't available, sh is used. The format of pre-built binaries for W...

github.com

Shunsuke Suzuki@seli07.bsky.social · 2y ago

The popular GitHub Action tj-actions/changed-files was compromised. To avoid this kind of threats, pinning action versions by full commit hash is recommended. You can do it using pinact, which is a CLI to pin GitHub Actions by one command. github.com/suzuki-shuns...

GitHub - suzuki-shunsuke/pinact: pinact is a CLI to edit GitHub Workflow and Composite action files and pin versions of Actions and Reusable Workflows. pinact can also update their versions and verify...

pinact is a CLI to edit GitHub Workflow and Composite action files and pin versions of Actions and Reusable Workflows. pinact can also update their versions and verify version annotations. - suzuki...

github.com

Shunsuke Suzuki@seli07.bsky.social · 2y ago

🎉 I'm really glad to announce my new OSS project. Securefix Action is GitHub Actions to fix code securely. It elevates the security of your workflows to the next level. It allows you to fix code without sharing a secret having strong permissions with workflows widely. github.com/securefix-ac...

GitHub - securefix-action/action: GitHub Action to fix code securely

GitHub Action to fix code securely. Contribute to securefix-action/action development by creating an account on GitHub.

github.com