Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Windows Tipps & SecurityGrafikkarte vor Überhitzung schützen: So geht’s(25.09.2026 um 08:00 Uhr)
••••••••••
Intelligence View
⚡ tsecurity.de Intelligence

CI/CD for Devs: GitHub Actions in 5 Minutes

You know that feeling when you realize the thing you’ve been running from, the thing that seemed super hard, is actually way simpler than you thought? Yeah. That was me with CI/CD. Back when I earned a bit of cred at work, I used to “…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

You know that feeling when you realize the thing you’ve been running from, the thing that seemed super hard, is actually way simpler than you thought?



Yeah. That was me with CI/CD.



Back when I earned a bit of cred at work, I used to “delegate” repo management and CI/CD. I say “delegate” because, honestly, I was just bad at it. The jargon, the layers of abstraction; it was all so damn annoying.



And if that’s not wild enough, I once tried to sit through a one-hour DevOps tutorial… and woke up at the 45-minute mark 😔



Eventually, I forced myself to think about CI/CD like a developer. And guess what? It’s stupid simple.



CI/CD is just... functions. Yep. Just functions. Let me show you.



This is for programmers like me; who "hate" CI/CD not because it’s evil, but because we’ve just been bad at it. Maybe it’s time to approach it like we would anything else: code first.









CI/CD



So yeah..CI/CD are just functions.



But not your usual functions. These are evented functions. You don’t run them manually; they get triggered by an event.



Now here’s the analogy:



A CI/CD pipeline has something called steps I like to call them mini-functions. Each step does one thing, just like a regular function.



For example:




// example.js
function downloadNodejs() {}
function setUpNodejs() {}
function checkOutTheRepo() {}
function runPnpmInstall() {}
function runPnpmRunTest() {}





These “steps” get composed into a higher-order function, aka a workflow:



function MyJavaScriptProjectWorkflow() {
function downloadNodejs() {}
function setUpNodejs() {}
function checkOutTheRepo() {}
function runPnpmInstall() {}
function runPnpmRunTest() {}
}





And this workflow only runs when you trigger an event:



event.emit("myevent")





What kind of events?




  • A push

  • A pull request

  • A merge

  • Basically, anything you do on a repo.



Now here’s the cool part; workflows can reuse other workflows. Instead of writing the setup logic yourself, you can use prebuilt actions like this:



function MyJavaScriptProjectWorkflow() {
uses: actions/setup-node@v4 // does downloadNodejs() + setUpNodejs()
uses: actions/checkout@v3 // does checkOutTheRepo()
function runPnpmInstall() {}
function runPnpmRunTest() {}
}





That’s pretty much the core of CI/CD.



But let’s build a real example so it sinks in.







Add Function CI Workflow



First, create a simple npm project with a test:



npm init -y
npm i -D mocha





Your file structure should look like this:



.github/
workflows/ci_add.yml
test/
app.js
main.js
.gitignore # add node_modules





In your package.json, update the scripts:



"scripts": {
"test": "mocha"
}





Initialize a Git repo:



git init





Here’s your simple library:



main.js



export function add(a, b) {
return a + b;
}





test/app.js



import { equal } from 'assert';
import { add } from '../main.js';

describe("add", () => {
it("should add", () => {
const res = add(7, 12);
equal(19, res);
});
});





Run your test locally:



npm run test





All good? Now let’s define the CI workflow.







.github/workflows/ci_add.yml





name: Node.js Add CI

on:
push:
branches: [ main ]

jobs:
ci:
runs-on: ubuntu-latest
steps:
- name: Checkout Code
uses: actions/checkout@v3

- name: Setup Node.js
uses: actions/setup-node@v3
with:
node-version: '18'

- name: Install Dependencies
run: npm install

- name: Run Tests
run: npm test





Let’s break this down; our mini-functions (steps) do the following:




  • Checkout the repo

  • Set up Node.js v18

  • Run npm install

  • Run tests with npm test



When does this run?



on:
push:
branches: [ main ]





Yup; on a git push. That’s our event. A function triggered by a real-world action.





Push your code and watch the workflow in action:



git add .
git commit -m "ready set go"
// add your remote
git push -u origin main





Head to the Actions tab in your GitHub repo, you’ll see logs from your first CI workflow run. easy...



workflow success



Workflow Expand



What you just did? That’s the CI part of CI/CD.



And CD? Honestly, it’s not that different. Whether you're publishing to npm (they’ve got an API + token), deploying to GitHub Pages, or pushing an app to Google Play; they all expose APIs. Just more evented functions.





CI/CD isn’t scary. It’s just code, functions reacting to events. Once you see it that way, all the DevOps jargon kind of melts away.



Let me know if this clicked, or if you’re still tempted to fall asleep during DevOps tutorials 😅



You can find me here on x



More Content:

Building Redis From Zero To Hero with Node.js - free




1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - CI/CD for Devs: GitHub Actions in 5 Minutes
id: 56f7a139-084f-4717-8535-187df4afeb8f
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-26
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-26"
        description = "YARA Signature for "
    strings:
        $str = "CI/CD for Devs: GitHub Actions" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("CICD for Devs GitHub Actions in 5 Minute")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*CICD for Devs GitHub Actions in 5 Minute*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "CICD for Devs GitHub Actions in 5 Minute"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich CI/CD for Devs: GitHub Actions in 5 Minu.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten CI/CD for Devs: GitHub Actions in 5 Minutes

Thematisch verwandte Begriffe: CICD, Devs, GitHub, Actions · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-100534 | OpenClaw versions before 2026.8.1 contain an authorization bypass vulne…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag