GitHub Actions Lockfiles, GitLab CVSS 10 CI Flaw, Google Cloud Storage Outage & Torvalds Builds Kernel Patches With Claude Code

This week on Ship It Weekly, GitHub Actions workflow lockfiles land in public preview, pinning actions and their dependencies to exact commits. GitLab shipped a critical patch release for CVE-2026-97229, a CVSS 10 CI/CD regex flaw that could let an unauthenticated attacker run code on the server. Google published its final report on two Cloud Storage incidents in us-central1, including a recurrence caused by an incomplete rollback. And Linus Torvalds pushed an experimental kernel branch with page-cache patches built using Claude Code, as maintainers debate dropping the mandatory AI attribution tag. The thread this week: know what you're actually running, from the commit you reviewed to the state a rollback really left behind and code someone can still explain. In the lightning round: a record Patch Tuesday with more than 1,400 CVEs and an actively exploited Windows Shell bypass, GitHub AI Scan for pull requests and agentic autofix going GA, AWS Strands Box, an open-source agent sandbox that keeps real credentials out of the agent's environment, and a Microsoft 365 outage through Global Secure Access. The human closer comes from Paul LaPosta's “Your error budgets don't know AI exists.” AI has split shipping a change from understanding it, and SLOs don't measure comprehension. Your SLO can tell you the service is up. It cannot tell you whether anyone still understands it. Programming note: Ship It Weekly turns one next month, so expect more conversations over the next couple of months, usually two a week, starting Monday with Rob Koch. Links GitHub Actions workflow lockfiles GitLab 19.4.2 / 19.3.5 / 19.2.8 patch release Google Cloud Storage incident report Linus Torvalds and Claude Code (Phoronix) Linux drops the Assisted-by requirement (Phoronix) October 2026 Patch Tuesday GitHub AI Scan for pull requests GA Agentic autofix GA AWS Strands Box Microsoft 365 Global Secure Access outage Your error budgets don't know AI exists (LeadDev) This week's On Call Brief