Shai-Hulud compromised a dev machine and raided GitHub org access: a post-mortem

Re:Shai-Hulud compromised a dev machine and raided GitHub or... by sallveburrpi on Sunday December 14, 2025 @09:45AM (#46263370)

Pushing directly to main seems crazy - for anything that is remotely important I would use a pull request/merge request pattern

[ Parent | on HN ]

Re:Shai-Hulud compromised a dev machine and raided GitHub or... by esseph on Sunday December 14, 2025 @10:00AM (#46263498)

Depends on the use case of the repo.

[ Parent | on HN ]

Re:Shai-Hulud compromised a dev machine and raided GitHub or... by otterley on Sunday December 14, 2025 @02:21PM (#46265917)

There's nothing wrong with pushing to main, as long as you don't blindly treat the head of the main branch as production-ready. It's a branch like any other; Git doesn't care what its name is.

[ Parent | on HN ]

Re:Shai-Hulud compromised a dev machine and raided GitHub or... by sallveburrpi on Sunday December 14, 2025 @08:49PM (#46269421)

Yea ofc I was implying that main is the branch that is pushed to production.

[ Parent | on HN ]