GitHub Actions Self-Hosted Runners: Fix Your Version Before the September 25 Enforcement If your CI/CD pipeline runs on self-hosted GitHub Actions runners, GitHub has already started intermittently blocking outdated ones. Brownouts began August 24, 2026 on github.com and GitHub Enterprise Cloud, and they escalate on a …

GitHub Apps and OAuth Apps Get Refresh Tokens: How to Migrate Off Long-Lived Access Tokens If you've built an OAuth App or a GitHub App that authenticates on behalf of users, there's a decent chance it's still handing out a gho_ or ghu_ token that never expires. On August 14, 2026, GitHub shipped token rotation for …

GitHub Copilot Added Kimi K3: How to Enable It (and Why GitHub Paused the Rollout on Day One) On August 6, 2026, GitHub shipped Kimi K3 — Moonshot AI's open-weight model — as a selectable model inside GitHub Copilot. Then, the same day, GitHub added an editor's note to its own changelog post saying it had paused the …

Docker Hub OIDC for GitHub Actions: Retire Your Stored Access Tokens If your CI pipeline pushes images to Docker Hub, there's a good chance a Personal Access Token (PAT) or Organization Access Token (OAT) is sitting in your GitHub repository secrets right now — valid for months, scoped broader than you'd like, and one …

GitHub Actions Now Holds Suspicious Workflow Runs Before They Touch Your Secrets On July 28, 2026, GitHub started automatically holding workflow runs it identifies as potentially malicious before they execute. If a run gets flagged, it sits in a pending state until a repository collaborator with write access reviews …

GitHub Models Retires July 30, 2026: How to Migrate Your Code and CI Workflows If any of your code, scripts, or GitHub Actions workflows call GitHub Models, they stop working on July 30, 2026. GitHub confirmed the playground, the model catalog, the inference API, and bring-your-own-key (BYOK) support are all being …

GitHub Actions Checkout v7: Fixing the Pwn Request Vulnerability Before July 16 If your CI pipeline uses pull_request_target and checks out the pull request's head commit, actions/checkout@v7 will now refuse to do it. That's not a bug — it's GitHub closing one of the most common CI/CD attack patterns in the ecosystem, …