GitHub Actions macOS 14 Runner Retirement: Survive the October Brownouts and Migrate Before November 2 Starting October 5, 2026 at 14:00 UTC, GitHub will deliberately fail every job that asks for a macOS 14 hosted runner, for ten hours at a time, on eight separate days this month. On November 2, 2026 the image goes …

GitHub's New Runner Deprecation API: Automate Your Self-Hosted Fleet Audit If you manage self-hosted GitHub Actions runners, you've probably already been checking versions by hand — SSH into a box, run ./run.sh --version, repeat for every machine. On September 3, 2026, GitHub shipped a REST API that makes that manual …

GitHub Actions Ubuntu 26.04 Migration: What Breaks When ubuntu-latest Moves On September 17, 2026, GitHub announced that the ubuntu-latest runner label is moving from Ubuntu 24.04 to Ubuntu 26.04, rolling out gradually between October 19 and November 19, 2026. If your workflows just say runs-on: ubuntu-latest and …

GitHub Actions' New vulnerability-alerts Permission: Read Dependabot Alerts Without a PAT If you've ever tried to have a GitHub Actions workflow check for open Dependabot alerts — to block a release, gate a merge, or post a Slack summary — you've probably hit a wall: the default GITHUB_TOKEN can't read them. The …

GitHub Actions Self-Hosted Runners: Fix Your Version Before the September 25 Enforcement If your CI/CD pipeline runs on self-hosted GitHub Actions runners, GitHub has already started intermittently blocking outdated ones. Brownouts began August 24, 2026 on github.com and GitHub Enterprise Cloud, and they escalate on a …

Docker Hub OIDC for GitHub Actions: Retire Your Stored Access Tokens If your CI pipeline pushes images to Docker Hub, there's a good chance a Personal Access Token (PAT) or Organization Access Token (OAT) is sitting in your GitHub repository secrets right now — valid for months, scoped broader than you'd like, and one …

GitHub Actions Now Holds Suspicious Workflow Runs Before They Touch Your Secrets On July 28, 2026, GitHub started automatically holding workflow runs it identifies as potentially malicious before they execute. If a run gets flagged, it sits in a pending state until a repository collaborator with write access reviews …

GitHub Models Retires July 30, 2026: How to Migrate Your Code and CI Workflows If any of your code, scripts, or GitHub Actions workflows call GitHub Models, they stop working on July 30, 2026. GitHub confirmed the playground, the model catalog, the inference API, and bring-your-own-key (BYOK) support are all being …

GitHub Actions Checkout v7: Fixing the Pwn Request Vulnerability Before July 16 If your CI pipeline uses pull_request_target and checks out the pull request's head commit, actions/checkout@v7 will now refuse to do it. That's not a bug — it's GitHub closing one of the most common CI/CD attack patterns in the ecosystem, …