AI 资讯
Indirect Prompt Injection Exploits GitHub's AI Agent to Leak Private Repository Data
GitLost is a prompt-injection exploit discovered by Noma Security that tricks GitHub's new Agentic Workflows into leaking private data. By embedding concealed instructions within public GitHub issues, attackers can circumvent security safeguards and induce AI agents to reveal confidential information in public comments. By Sergio De Simone
AI 资讯
QGIS: l'extension Universal xy converter qui convertit vos coordonnées en une seconde
Universal XY Converter est un plugin QGIS pratique qui simplifie la conversion, la manipulation et le traitement rapide de coordonnées géographiques et projetées directement au sein de votre environnement de travail. 🎥 Tutoriel vidéo Découvrez la prise en main pas à pas en vidéo : 📖 Documentation complète Consultez le manuel d'utilisation officiel sur GitHub : 👉 User Manual - QGIS Plugin Universal XY Converter 🌟 Fonctionnalités clés Conversion rapide de coordonnées : Transformez facilement des paires de coordonnées (X, Y) entre différents systèmes de référence spatiales (CRS). Import & Traitement par lot : Prise en charge fluide de listes de points pour accélérer le traitement de vos relevés de terrain. Gain de temps au quotidien : Évite les manipulations manuelles complexes ou l'utilisation d'outils externes pour vérifier et convertir vos données de géolocalisation. 🚀 Comment les installer et démarrer ? Ouvrez QGIS . Allez dans le menu Extensions > Installer/Gérer les extensions . Dans la barre de recherche, tapez XY Converter (ou Universal Map2web ). Sélectionnez l'extension puis cliquez sur Installer l'extension . 💬 Vos retours m'intéressent ! Avez-vous testé ces outils ? N'hésitez pas à laisser un commentaire ci-dessous avec vos retours, vos questions ou vos idées d'amélioration !
开源项目
🔥 Automattic / harper - Offline, privacy-first grammar checker. Fast, open-source, R
GitHub热门项目 | Offline, privacy-first grammar checker. Fast, open-source, Rust-powered | Stars: 11,873 | 590 stars today | 语言: Rust
开源项目
🔥 freemocap / freemocap - Free Motion Capture for Everyone 💀✨
GitHub热门项目 | Free Motion Capture for Everyone 💀✨ | Stars: 9,664 | 74 stars today | 语言: TypeScript
开源项目
🔥 freestylefly / awesome-gpt-image-2 - Prompt as Code | GPT-Image2 工业级提示词引擎与模板库,470+ 个案例逆向工程,20+ 套工
GitHub热门项目 | Prompt as Code | GPT-Image2 工业级提示词引擎与模板库,470+ 个案例逆向工程,20+ 套工业级模板,并提炼出Skills,持续更新中 | Stars: 8,643 | 49 stars today | 语言: JavaScript
开源项目
🔥 vnpy / vnpy - 基于Python的开源量化交易平台开发框架
GitHub热门项目 | 基于Python的开源量化交易平台开发框架 | Stars: 43,785 | 137 stars today | 语言: Python
开源项目
🔥 raullenchai / Rapid-MLX - The fastest local AI engine for Apple Silicon. 4.2x faster t
GitHub热门项目 | The fastest local AI engine for Apple Silicon. 4.2x faster than Ollama, 0.08s cached TTFT, 100% tool calling. 17 tool parsers, prompt cache, reasoning separation, cloud routing. Drop-in OpenAI replacement. Works with Claude Code, Cursor, Aider. | Stars: 3,351 | 18 stars today | 语言: Python
开源项目
🔥 oraios / serena - A powerful MCP toolkit for coding, providing semantic retrie
GitHub热门项目 | A powerful MCP toolkit for coding, providing semantic retrieval and editing capabilities - the IDE for your agent | Stars: 26,786 | 85 stars today | 语言: Python
开源项目
🔥 slavakurilyak / awesome-ai-agents - Awesome list of 300+ agentic AI resources
GitHub热门项目 | Awesome list of 300+ agentic AI resources | Stars: 2,029 | 67 stars today | 语言: Python
开发者
Stop Running `terraform apply` From Your Laptop: Building Your First Terraform CI/CD Pipeline with GitHub Actions
One of the biggest mistakes beginners make when learning Terraform is treating their local machine as the deployment server. A typical workflow looks like this: terraform init terraform plan terraform apply While this approach is perfectly fine for learning, it quickly becomes problematic when working on real-world projects with multiple engineers. Consider these questions: Who deployed the infrastructure? Was the infrastructure reviewed before deployment? Can someone else reproduce the deployment? What happens if the engineer's laptop is lost or misconfigured? How do we know exactly what changed? These are some of the reasons Infrastructure as Code (IaC) is almost always integrated with Continuous Integration and Continuous Deployment (CI/CD) pipelines in professional environments. In this article, we'll build a simple Terraform CI/CD pipeline using GitHub Actions. Instead of focusing only on the YAML syntax, we'll first understand why each stage exists and how they work together to produce safe, repeatable infrastructure deployments. What is Terraform CI/CD? Terraform CI/CD is the process of automating the validation, planning, and deployment of infrastructure whenever changes are made to Terraform code. Instead of running Terraform commands manually from a developer's laptop, a CI/CD platform executes those commands automatically in a controlled environment. The workflow typically looks like this: Developer │ ▼ Git Push │ ▼ GitHub Repository │ ▼ GitHub Actions │ ▼ Terraform Init │ ▼ Terraform Validate │ ▼ Terraform Plan │ ▼ Manual Approval │ ▼ Terraform Apply │ ▼ AWS Infrastructure This approach provides consistency, visibility, and security while reducing the chances of human error. Why Not Run Terraform Manually? Running Terraform from your laptop works well for personal projects, but it introduces several risks in a team environment. Manual Deployment CI/CD Deployment Requires someone to remember every command Runs automatically Easy to skip validation Validat
开源项目
🔥 Julian-adv / OpenMMO
GitHub热门项目 | | Stars: 1,130 | 395 stars today | 语言: Rust
AI 资讯
I Built urldn-link-check — A GitHub Action to Catch Broken Links Before They Reach Production
Documentation is often the last thing developers think about—until a broken link frustrates users or a README sends someone to a 404 page. I wanted a simple way to automatically verify links in Markdown documentation during CI, so I built urldn-link-check. It's an open-source GitHub Action and CLI that scans your documentation and reports issues before they're merged. Features ✅ Detect broken links (404/500) ↪️ Detect redirect chains 🔒 Detect insecure HTTP links 📏 Find overly long URLs 📄 Scan Markdown & MDX files ⚡ Fast concurrent scanning 💬 GitHub PR summaries 📊 JSON & Markdown reports Installation npm install -D urldn-link-check or npx urldn-link-check . GitHub Action uses: urldn/link-check@v1 That's it. Every push or pull request can automatically verify your documentation. Why I Built It While maintaining documentation, I noticed that broken links often go unnoticed until someone reports them. Instead of checking them manually, I wanted a lightweight tool that integrates directly into GitHub Actions and fits naturally into a CI workflow. Open Source The project is MIT licensed and contributions are welcome. ⭐ GitHub: https://github.com/urldn/link-check 📦 npm: https://www.npmjs.com/package/urldn-link-check https://www.npmjs.com/package/urldn-link-check This is the first developer tool in the URLDN ecosystem, with more open-source projects planned in the future. If you have ideas or feedback, I'd love to hear them.
AI 资讯
Copilot vs. raw API access: What are you actually paying for?
Copilot now bills usage at listed API rates. Compare direct model access with the coding workflow, policy, and harness work around it. The post Copilot vs. raw API access: What are you actually paying for? appeared first on The GitHub Blog .
AI 资讯
The Cheap Way to Add AI Review to CI: Small Local Models Plus Prompt Caching
I wired an AI code reviewer into CI, felt clever, and then looked at the bill after a busy week of PRs. Every push, every commit, sending full diffs to a big frontier model. It added up faster than I expected, and most of what it was reviewing was formatting changes and README edits that did not need a genius reading them. So I rebuilt it as two tiers, and the cost dropped hard without losing the catches that mattered. The idea is simple. Do not send everything to the expensive model. Use a cheap model as a bouncer that decides what is even worth escalating, and reserve the big model (with caching turned on) for the files that could actually hurt you. Tier one: a cheap triage pass The first tier looks at the diff and answers one question: is anything here risky enough to justify a real review? That is a classification task, and classification does not need a frontier model. I run this tier on a small local model. On my own machine that is Ollama with qwen2.5-coder, but in CI it can be a self-hosted small model or the cheapest cloud tier your provider offers. The job is triage, not judgment. The triage prompt is deliberately narrow. I do not ask it to review. I ask it to route: You are a triage filter for code review. For the diff below, output JSON only: { "risk": "low" | "high", "reason": " <one short phrase > " } Mark "high" if the diff touches: auth, access control, money/token math, cryptography, SQL or shell string building, deserialization, file paths, network calls, or anything that changes who can do what. Mark "low" for formatting, comments, docs, tests, renames, and config bumps. DIFF: <diff here > A small model is perfectly good at "does this touch auth or money." When it says low, CI posts a one-line "no high-risk changes detected" and stops. No expensive call. In practice that shortcuts the majority of PRs, because most PRs really are docs, tests, and plumbing. Tier two: the big model, but only on the risky files, with caching When tier one says high, t
开源项目
🔥 block / buzz - A hive mind communication platform
GitHub热门项目 | A hive mind communication platform | Stars: 3,079 | 2,720 stars this week | 语言: Rust
开源项目
🔥 Javis603 / token-monitor - Real-time token, cost, and AI limits widget with multi-devic
GitHub热门项目 | Real-time token, cost, and AI limits widget with multi-device sync for Claude Code, Codex, OpenCode, Hermes, OpenClaw, Cursor, Antigravity and more. | 为 AI Tools 打造的即时Token、成本与限额监控桌面组件,支持多设备同步 | Stars: 904 | 199 stars this week | 语言: JavaScript
开源项目
🔥 rustdesk / rustdesk-server - RustDesk Server Program
GitHub热门项目 | RustDesk Server Program | Stars: 10,102 | 10 stars today | 语言: Rust
开源项目
🔥 rtk-ai / rtk - CLI proxy that reduces LLM token consumption by 60-90% on co
GitHub热门项目 | CLI proxy that reduces LLM token consumption by 60-90% on common dev commands. Single Rust binary, zero dependencies | Stars: 72,532 | 274 stars today | 语言: Rust
开源项目
🔥 Pumpkin-MC / Pumpkin - Empowering everyone to host fast and efficient Minecraft ser
GitHub热门项目 | Empowering everyone to host fast and efficient Minecraft servers. | Stars: 8,141 | 96 stars today | 语言: Rust
开源项目
🔥 HughYau / qiushi-skill - 求是Skill——从经典唯物辩证法与实践哲学中提炼出一条总原则和九大方法论工具武装AI大脑。Qiushi-Skill:
GitHub热门项目 | 求是Skill——从经典唯物辩证法与实践哲学中提炼出一条总原则和九大方法论工具武装AI大脑。Qiushi-Skill: Build agents that investigate first, focus on the main contradiction, validate in practice, and keep pushing until the work is actually done. | Stars: 3,597 | 14 stars today | 语言: JavaScript