Tag

#github-actions

Tagged “github-actions”

30 articles

Xcode 27 runner image on GitHub-hosted macOS moves to macOS 27

GitHub bumped the operating system underneath its public-preview Xcode 27 runner image from macOS 26 to macOS 27, per the September 10 changelog. The runner labels stay the same, so the OS shift lands on the next job that requests them, with no workflow edit.

Sep 11, 2026 · Maya Okonkwo Security & supply chain

GTIG's agentic threat report is a CI/CD problem, not just an AI problem

Google's Threat Intelligence Group documents DUSTMAKER, an OIDC-stealing supply-chain payload from UNC6780 that ships valid SLSA Build 3 attestations. The moment a signed provenance line stops being a defence is the moment CI/CD owners have to rethink runner trust.

Sep 10, 2026 · Tomás Vega CI observability

GitHub Actions tracing without editing a single workflow file

A CNCF write-up walks through wiring the OpenTelemetry Collector's alpha githubreceiver to org-level Actions webhooks, turning workflow_run and workflow_job events straight into OTLP spans.

Sep 8, 2026 · Priya Nair Code quality & testing

GitHub splits Code Quality off the Actions billing meter

GitHub Code Quality CodeQL workflows now run on a dedicated Actions path, per an August 20 changelog. Their runs no longer count against a repo's regular Actions usage, and no longer sit in the same workflow-run history as the rest of its CI.

Aug 24, 2026 · Maya Okonkwo Runners & infrastructure

Windows 11 arm64 with VS2026 goes GA on GitHub-hosted runners

GitHub Actions promoted its Windows 11 arm64 image with Visual Studio 2026 to general availability on both standard and larger GitHub-hosted runners. For teams shipping native ARM Windows binaries out of CI, the self-hosted detour stops being the only option.

Aug 24, 2026 · Maya Okonkwo Security

CodeQL 2.26.3 retunes its Actions queries and drops the self-hosted module

CodeQL 2.26.3 reworks how the engine reasons about GitHub Actions workflows, tightening output-clobbering, cache-poisoning and env-var injection queries and removing the self-hosted runner module. Hosted code scanning is already on the new pack, so the next full run may move alert counts in both directions.

Aug 23, 2026 · Maya Okonkwo Security & supply chain

Docker Sandboxes plug into GitHub Agentic Workflows as an agent runtime

Docker has published a walk-through of running an AI coding agent inside a Docker Sandbox as part of a GitHub Actions job, with the sandbox microVM, a private Docker daemon and a network allowlist doing the isolation. The example moves the agent's blast radius off the runner and behind a policy the workflow file can see.

Aug 21, 2026 · Tomás Vega Security & supply chain

A devops.com walkthrough stacks four open-source security gates into GitHub Actions

devops.com published a build-it-yourself piece that stitches npm audit, Snyk, Trivy, CodeQL and OWASP ZAP into a single GitHub Actions pipeline. It is a decent map of what teams can gate on without an enterprise SKU, but stacking five scanners has an operational cost the article does not spend on.

Aug 16, 2026 · Maya Okonkwo Security

CodeQL 2.26.2 trims what counts as safe: fresh alerts incoming

GitHub's static analysis engine adds Swift 6.3.3 and Kotlin 2.4.10 support in CodeQL 2.26.2, and quietly removes a batch of sanitizers that used to make path injection and URL redirection findings disappear.

Aug 10, 2026 · Tomás Vega Incident response

GitHub pauses the Kimi K3 rollout in Copilot while it works a GitHub Actions incident

GitHub says the general-availability rollout of Kimi K3 in Copilot is temporarily paused while it mitigates an incident with GitHub Actions, per an editor's note added to the August 6 changelog. Pricing has been published; the resume time has not.

Aug 7, 2026 · Maya Okonkwo Security & supply chain

Docker Hub gets OIDC federation for GitHub Actions, retiring the PAT-in-a-secret pattern

Docker has added OpenID Connect authentication for GitHub Actions on Team, Business and Docker Hardened Images plans, so workflows push and pull images with a short-lived per-run token instead of a stored Personal Access Token. It closes off one of the last static credentials still sitting in most Actions repos.

Aug 1, 2026 · Maya Okonkwo Security & supply chain

GitHub Actions freezes suspected-malicious workflow runs until a human signs off

GitHub has flipped Actions into a hold-first posture for workflow runs it flags as potentially malicious on public repositories: the run pauses until a collaborator with write access approves it from an authenticated web session. The change targets a wave of credential-theft attacks that push booby-trapped workflow files with stolen tokens.

Jul 28, 2026 · Tomás Vega Security & supply chain

Auditors, OIDC and the trust policy most teams get wrong

A DevOps.com walkthrough by Artur Yolchyan lays out a SOC 2-shaped CI/CD pipeline on GitHub Actions and AWS: multi-account isolation, OIDC federation locked to one repo and branch, and the same container image retagged all the way to production. The interesting part is not the account topology; it is the one line in the trust policy that decides who can talk to your ECR.

Jul 24, 2026 · Tomás Vega Security & supply chain

The npm worm that shipped with valid SLSA provenance

A DevOps.com analysis of the Miasma npm worm makes an uncomfortable case: signing and provenance told the honest truth, and the pipeline still shipped malware. When the build platform itself is the attack surface, a green attestation is a description of the failure, not a defence against it.

Jul 22, 2026 · Tomás Vega Security & supply chain

The workstation is in scope now

A DevOps.com essay argues the laptop that pushes commits belongs inside the supply-chain threat model, citing the Megalodon campaign that injected malicious GitHub Actions workflows into thousands of repositories and a separate malicious VS Code extension incident. What CI-side controls actually catch this, and where the pipeline runs out of leverage.

Jul 19, 2026 · Tomás Vega Runners & infrastructure

Xcode 27 lands on GitHub-hosted runners, and the naming rule quietly changed

GitHub Actions added an Xcode 27 image in public preview on its arm64 macOS runners. The bigger shift is buried in the changelog: images are now keyed to the Xcode major version instead of the OS, one Xcode per image.

Jul 19, 2026 · Priya Nair Supply-chain security

Cordyceps: when a stranger's pull request runs as a maintainer

Researchers at Novee catalogue Cordyceps, a class of CI/CD supply-chain exploit where pull requests and comments from untrusted contributors get executed with maintainer permissions. A scan of 30,000 high-impact repositories flagged 654 candidates and confirmed over 300 as fully exploitable, with named blast radius inside Microsoft, Google, Apache and Cloudflare.

Jul 16, 2026 · Tomás Vega Security & supply chain

setup-java 5.5.0 adds JDK signature verification, if you remember to enable it

GitHub's actions/setup-java 5.5.0 adds opt-in GPG signature verification for downloaded JDKs, plus a Kona distribution parameter and a set of Maven quality fixes. It closes a real supply-chain gap for Java CI jobs, but existing pipelines keep pulling unsigned JDKs until someone flips the switch.

Jul 9, 2026 · Tomás Vega Security & supply chain

Copilot CLI drops the PAT requirement inside GitHub Actions

GitHub says Copilot CLI, when invoked from a GitHub Actions workflow, will now accept the built-in GITHUB_TOKEN. That retires one of the last long-lived personal tokens teams were carrying just to script Copilot from CI.

Jul 4, 2026 · Maya Okonkwo Security & supply chain

GitHub Actions hands fork triggers a read-only cache token

GitHub Actions now issues read-only cache tokens to workflow events fired from outside a repository's collaborator set, applying least privilege to the default-branch cache so untrusted triggers cannot poison entries the next push reuses.

Jun 30, 2026 · Tomás Vega Runners & infrastructure

GitHub-hosted larger runners pick up RHEL 9 and RHEL 10 in public preview

GitHub's larger hosted runners now offer Red Hat Enterprise Linux 9 and 10 images in public preview, a partnership with Red Hat aimed at shops that have been self-hosting Actions just to keep production-like CI on Red Hat.

Jun 29, 2026 · Maya Okonkwo Runners & infrastructure

GitHub lets org admins switch off the default hosted runner labels

Organizations on Actions can now disable standard hosted runner labels such as `ubuntu-latest` at the org level, per the June 25 changelog. The toggle turns the default runner pool from an implicit allowlist into a catalogue platform teams have to maintain.

Jun 28, 2026 · Maya Okonkwo Platform engineering

GitHub Actions adds a background marker, and the linear job stops being the only shape

GitHub Actions now lets steps inside a job run concurrently with a 'background' marker plus 'wait', 'cancel' and 'parallel' helpers, breaking the sequential-only model that has defined Actions jobs since launch.

Jun 26, 2026 · Priya Nair Platform engineering

A self-hosted Kubernetes diagnostic agent shipped by GitOps: the CNCF walkthrough

A CNCF blog post lays out a read-only, in-cluster AI agent whose CI/CD chain runs entirely on GitHub Actions and Argo CD Image Updater, with no data leaving the cluster and no cloud AI provider in the loop.

Jun 25, 2026 · Maya Okonkwo Runners & infrastructure

GitHub Actions lets custom runner images stack on other custom images

Custom images for GitHub-hosted runners can now be built on top of other custom images, per the June 18 changelog. The shift turns runner provisioning into a layered chain that platform teams can govern the same way they manage container base images.

Jun 19, 2026 · Maya Okonkwo Security

actions/checkout v7 refuses fork PR code in pull_request_target

GitHub shipped actions/checkout v7, which fails by default when a workflow triggered by pull_request_target or workflow_run tries to fetch the head of a fork's pull request. Same-repo PRs and the standard pull_request event are unaffected; a deliberately conspicuous opt-out exists for teams who really mean it.

Jun 18, 2026 · Tomás Vega Security & supply chain

GitHub Actions hands platform teams a workflow-trigger allow list

GitHub Actions is rolling out workflow execution protections in public preview at the enterprise, organization, and repository levels, letting administrators define who and what can trigger workflows. It's the platform-owned trigger gate the CI/CD industry has been quietly working toward for years.

Jun 18, 2026 · Tomás Vega Security & supply chain

Pinning every CI action to a commit SHA is becoming the new minimum

A new write-up from the Cilium maintainers lays out a concrete playbook for locking down CI/CD dependencies, full-SHA pinning for every action, digest-pinned containers, vendored Go modules, and Renovate with a release-age cooldown. The pattern matters even if you do not ship eBPF for a living.

Jun 16, 2026 · Tomás Vega Security & supply chain

GitHub Agentic Workflows drop personal access tokens for the built-in Actions token

Agentic workflows on GitHub can now authenticate with the ephemeral GITHUB_TOKEN instead of a long-lived personal access token. It is a quiet credential-hygiene win that closes one of the messier blast radii in agent-driven CI.

Jun 15, 2026 · Tomás Vega Runners & infrastructure

GitHub Actions resumes self-hosted runner version enforcement

Self-hosted runners must register on 2.329.0 or later and install each new release within 30 days, with full enforcement landing September 25, 2026 on github.com. The change moves runner version management from a hygiene task into a fleet-inventory problem.

Jun 15, 2026 · Maya Okonkwo