GitHub Actions Lockfiles, GitLab CVSS 10 CI Flaw, Google Cloud Storage Outage & Torvalds Builds Kernel Patches With Claude Code

This week on Ship It Weekly, GitHub Actions workflow lockfiles land in public preview, pinning actions and their dependencies to exact commits. GitLab shipped a critical patch release for CVE-2026-97229, a CVSS 10 CI/CD regex flaw that could let an unauthenticated attacker run code on the server. Google published its final report on two Cloud Storage incidents in us-central1, including a recurrence caused by an incomplete rollback. And Linus Torvalds pushed an experimental kernel branch with page-cache patches built using Claude Code, as maintainers debate dropping the mandatory AI attribution tag.The thread this week: know what you're actually running, from the commit you reviewed to the state a rollback really left behind and code someone can still explain.In the lightning round: a record Patch Tuesday with more than 1,400 CVEs and an actively exploited Windows Shell bypass, GitHub AI Scan for pull requests and agentic autofix going GA, AWS Strands Box, an open-source agent sandbox that keeps real credentials out of the agent's environment, and a Microsoft 365 outage through Global Secure Access.The human closer comes from Paul LaPosta's “Your error budgets don't know AI exists.” AI has split shipping a change from understanding it, and SLOs don't measure comprehension. Your SLO can tell you the service is up. It cannot tell you whether anyone still understands it.Programming note: Ship It Weekly turns one next month, so expect more conversations over the next couple of months, usually two a week, starting Monday with Rob Koch.LinksGitHub Actions workflow lockfilesGitLab 19.4.2 / 19.3.5 / 19.2.8 patch releaseGoogle Cloud Storage incident reportLinus Torvalds and Claude Code (Phoronix)Linux drops the Assisted-by requirement (Phoronix)October 2026 Patch TuesdayGitHub AI Scan for pull requests GAAgentic autofix GAAWS Strands BoxMicrosoft 365 Global Secure Access outageYour error budgets don't know AI exists (LeadDev)This week's On Call Brief