# \#infra-and-security **URL:** https://forum.ansible.com/tag/infra-and-security/492.md [Latest](https://forum.ansible.com/latest.md) · [Categories](https://forum.ansible.com/categories.md) · [Tags](https://forum.ansible.com/tags.md) --- ## [Ansible CRA Stewardship Update - Light Compliance](https://forum.ansible.com/t/ansible-cra-stewardship-update-light-compliance/46295)
**Author:** [@dbrennand](https://forum.ansible.com/u/dbrennand)\ **Replies:** 0\ **Last updated:** [September 11, 2026, 2:39pm UTC](https://forum.ansible.com/t/ansible-cra-stewardship-update-light-compliance/46295 "2026-09-11T14:39:41Z")
Hi Ansible Community! Welcome back to our ongoing series on the EU Cyber Resilience Act (CRA). Today’s post is a short update on the stewardship status of the Ansible project. We are happy to report that, as of last we… --- ## [CRA: Updating SECURITY.md](https://forum.ansible.com/t/cra-updating-security-md/46223)
**Author:** [@gundalow](https://forum.ansible.com/u/gundalow)\ **Replies:** 0\ **Last updated:** [August 25, 2026, 12:28pm UTC](https://forum.ansible.com/t/cra-updating-security-md/46223 "2026-08-25T12:28:15Z")
Hi folks Summary You might see some PRs to update SECURITY.md updates rolling out across Ansible repos. The process for reporting potential security concerns remains the same, email security@ansible.com. The updates ju… --- ## [Pinning GHA actions/shared workflows to commits](https://forum.ansible.com/t/pinning-gha-actions-shared-workflows-to-commits/46118)
**Author:** [@felixfontein](https://forum.ansible.com/u/felixfontein)\ **Replies:** 5\ **Last updated:** [August 18, 2026, 9:10am UTC](https://forum.ansible.com/t/pinning-gha-actions-shared-workflows-to-commits/46118 "2026-08-18T09:10:05Z")
There’s currently a push to pin GHA actions and shared workflows to commit hashes (to thwart certain types of supply chain attacks). While doing that for several repos, I found several (potential) problems and solutions. … --- ## [Security as Default, Not an Afterthought: The CRA's Real Message](https://forum.ansible.com/t/security-as-default-not-an-afterthought-the-cras-real-message/45795)
**Author:** [@anwesha](https://forum.ansible.com/u/anwesha)\ **Replies:** 0\ **Last updated:** [May 13, 2026, 7:17pm UTC](https://forum.ansible.com/t/security-as-default-not-an-afterthought-the-cras-real-message/45795 "2026-05-13T19:17:27Z")
In a recent forum post, we introduced the overall concept of EU Cyber Resilience Act (CRA) and what it means for the Ansible community, the timeline, who is affected, and Red Hat’s role as an open-source software steward… --- ## [Ansible community roadmap 2026](https://forum.ansible.com/t/ansible-community-roadmap-2026/45522)
**Author:** [@oranod](https://forum.ansible.com/u/oranod)\ **Replies:** 1\ **Last updated:** [May 1, 2026, 7:36am UTC](https://forum.ansible.com/t/ansible-community-roadmap-2026/45522 "2026-05-01T07:36:10Z")
Hi everyone, Since the Contributor Summit at CfgMgmtCamp we’ve been working on defining our roadmap for 2026. We’ve gone through all our notes and have put together some high-level descriptions of what we’d like to achi… --- ## [EU Cyber Resilience Act (CRA) and what it means for Ansible?](https://forum.ansible.com/t/eu-cyber-resilience-act-cra-and-what-it-means-for-ansible/45716)
**Author:** [@anwesha](https://forum.ansible.com/u/anwesha)\ **Replies:** 0\ **Last updated:** [April 21, 2026, 11:04am UTC](https://forum.ansible.com/t/eu-cyber-resilience-act-cra-and-what-it-means-for-ansible/45716 "2026-04-21T11:04:06Z")
Hello everyone, We are reaching out to share an important update regarding the evolving regulatory landscape in Europe and how it impacts the Ansible ecosystem. The European Union has introduced the Cyber Resilience Act… --- ## [IMPORTANT: github.com/ansible now requires signed commits](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520)
**Author:** [@gundalow](https://forum.ansible.com/u/gundalow)\ **Replies:** 14\ **Last updated:** [March 24, 2026, 6:18pm UTC](https://forum.ansible.com/t/important-github-com-ansible-now-requires-signed-commits/45520 "2026-03-24T18:18:52Z")
Overview From Monday 16th March we will be requiring Git signed commits for all repos under github.com/ansible/. Red Hat is continually looking at improving the supply chain, so expect further improvements as Ansible ad… --- ## [Feature Request: Support OpenID Connect (OIDC) Trusted Publishing for Ansible Collections on Galaxy](https://forum.ansible.com/t/feature-request-support-openid-connect-oidc-trusted-publishing-for-ansible-collections-on-galaxy/45110)
**Author:** [@ChihweiLHBird](https://forum.ansible.com/u/ChihweiLHBird)\ **Replies:** 2\ **Last updated:** [January 15, 2026, 6:04am UTC](https://forum.ansible.com/t/feature-request-support-openid-connect-oidc-trusted-publishing-for-ansible-collections-on-galaxy/45110 "2026-01-15T06:04:49Z")
Supporting OpenID Connect (OIDC)-based trusted publishing would enable Ansible Collection developers to publish directly from GitHub workflows without storing long-lived API tokens or secrets. This tokenless approach wou…