Tag

#github

Tagged “github”

24 articles

GitHub carves credential revocation into per-token-type actions

GitHub's incident-response tooling now lets enterprise owners and org admins deauthorize or revoke user credentials one token type at a time, in the UI and via API. The blast radius of a bad revoke shrinks, and every action lands in the audit log.

Aug 23, 2026 · Maya Okonkwo Governance

GitHub takes rule insights up a level: bypass counts across the whole org

GitHub's rule insights dashboard is in public preview at the organization level, adding aggregated ruleset evaluation metrics, a top-repos-by-bypass view, filters and a CSV export. Platform teams that already run rulesets as a gating primitive get a single pane for who is actually going around them.

Aug 22, 2026 · Maya Okonkwo Runners & infrastructure

GitHub says 2.9 billion commits a month, and CI is the downstream tenant

The New Stack puts GitHub's monthly load at 2.9 billion commits, 130 million merged pull requests and 24 million new repositories, and reports the platform is straining under it. For teams running on Actions, that is a queue-depth story more than a growth story.

Aug 21, 2026 · Maya Okonkwo Incident response

AWS wires DevOps Agent into CodePipeline failures via CloudWatch and Lambda

AWS published an integration pattern that routes CodePipeline failures to its DevOps Agent through a CloudWatch alarm and a small Lambda webhook, aimed at trimming the manual sweep across services, logs and pipeline stages when a GitHub-hosted deploy breaks.

Aug 18, 2026 · Maya Okonkwo Developer experience

GitHub's Dependabot playbook: group the version PRs, slow the cadence, keep security fast

A GitHub blog post dated 2026-07-29 lays out the three-lever config for making Dependabot survivable on a busy repo: group version updates into one PR, slow the schedule to weekly or monthly, and let security updates keep flowing on their own timing. It is a few lines of YAML that turn a bot most teams half-mute back into something they can triage.

Aug 14, 2026 · Priya Nair Developer experience

GitHub adds an in-product path off branch protection rules

A GitHub changelog dated 2026-08-11 adds a one-click conversion from legacy branch protection rules into repository rulesets, done inside repo settings. If you have been putting off the migration across a fleet of repos, the tax on doing it just dropped.

Aug 14, 2026 · Priya Nair Developer experience

GitHub's native stacked pull requests land in public preview

GitHub is rolling out native stacked pull requests in public preview: one big change split into a chain of dependent, layer-sized PRs, with a stack map on each one and a merge that lands every layer beneath the latest ready PR in a single operation. Branch protections and required status checks still apply, merge queue support is coming in over the following weeks, and there is a new gh-stack CLI.

Aug 9, 2026 · Priya Nair Developer experience

Copilot code review picks up a firewall, custom runners, and head-branch instructions

GitHub's Copilot code review can now run with a firewall, custom setup steps and independent runner configurations, and custom instructions are read from the pull request's head branch rather than the base branch.

Jul 25, 2026 · Priya Nair Security & supply chain

FakeGit floods GitHub with malicious repos aimed at coding agents

Island researchers say a campaign called FakeGit spun up about 7,600 malicious GitHub repositories, many posing as AI skills or MCP servers, to hand SmartLoader and StealC to developers and to the agents fetching capabilities on their behalf.

Jul 24, 2026 · Maya Okonkwo Platform engineering

GitHub's MCP Server tracks the stateless MCP spec, and the Redis session drops out

Ahead of a 28 July 2026 move to a stateless MCP core, GitHub says its MCP Server has been updated to run without per-session Redis state. For teams wiring coding agents into CI, that changes what the server has to remember between calls.

Jul 24, 2026 · Maya Okonkwo Code quality & testing

GitHub Code Quality goes GA, and the billing meter turns on with it

GitHub Code Quality moved to general availability on GitHub Enterprise Cloud and GitHub Team on July 20, pairing CodeQL's analysis with AI-assisted detection and Copilot Autofix inside pull requests. The pricing landed the same day: $10 per active committer per month plus usage charges for AI work and CodeQL compute.

Jul 22, 2026 · Tomás Vega Security & supply chain

Secret scanning custom patterns get a REST API, so you can PR your detectors

GitHub made REST endpoints for secret scanning custom patterns generally available on July 13, 2026. Detectors can now be created, listed, updated and deleted via API at repository, organization and enterprise scope, though dry runs and the final publish step still happen in the UI.

Jul 21, 2026 · Priya Nair Developer experience

GitHub tags AI-generated code scanning alerts on the PR itself

Code scanning now surfaces AI-powered security detections directly on pull requests, tagged next to CodeQL findings so reviewers can tell them apart. The alerts are informational and never block a merge, but they finally land where reviewers already look.

Jul 16, 2026 · Priya Nair Security & supply chain

GitHub pulls /security-review out of the CLI and into the Copilot app

GitHub's /security-review slash command is now in public preview inside the Copilot app, running a security pass on in-flight code changes before they ever reach a pull request. It is the same review that was already in the Copilot CLI, moved closer to where the code is being written.

Jul 15, 2026 · Tomás Vega Supply chain security

Dependabot learns to wait: version-update PRs now sit for three days by default

GitHub is flipping Dependabot version updates to a default three-day package cooldown. A new release has to sit on its registry for at least three days before Dependabot will open a version-update PR; security updates are exempt and still open immediately.

Jul 15, 2026 · Tomás Vega Developer experience

Autofix that reads more than one file: GitHub previews agentic code scanning fixes

GitHub's agentic autofix for code scanning alerts is in public preview, expanding remediation from the alert location out to the files around it. For CI/CD teams, a single alert now maps to a codebase-shaped change instead of a one-line patch.

Jul 14, 2026 · Priya Nair Security & supply chain

Datadog says months-long GitHub recon out of dormant 'ghost' accounts is prep for supply-chain attacks

Datadog security researchers say overlapping months-long campaigns have been abusing GitHub's public API and reactivating more than 50 long-dormant accounts to map organizations and their engineers. The setup looks a lot like the reconnaissance phase of a supply-chain intrusion.

Jul 14, 2026 · Maya Okonkwo Supply-chain security

Innersource security advisories go GA: a private channel for private vulns

GitHub Advanced Security now lets enterprise customers publish security advisories that stay inside the enterprise, and Dependabot picks them up like it would a public CVE. Useful, narrow, and only as good as the discipline behind it.

Jul 11, 2026 · Tomás Vega Security & supply chain

GitHub starts watching the whole public site for your leaked secrets

GitHub is previewing public monitoring for enterprise secret scanning: real-time detection across all of public github.com, with leaks attributed back to your organisation. Useful, and a preview, so read the small print.

Jul 6, 2026 · Tomás Vega Platform engineering

GitHub sets July 30 as the hard shutdown for GitHub Models

GitHub published a July 1 changelog entry confirming GitHub Models will be fully retired on July 30, 2026. The earlier closure to new customers now has a matching end date, and any pipeline still calling into the service has a fixed migration window of roughly four weeks.

Jul 5, 2026 · Maya Okonkwo Incident response

GitHub ships a one-click self-revoke for users whose credentials just leaked

An individual GitHub Enterprise member can now wipe every credential they own, personal access tokens, SSH keys, OAuth tokens and SSO authorizations, in a single action from the Settings page. Containment used to be a scavenger hunt across four menus.

Jun 25, 2026 · Tomás Vega Code quality & testing

Code Quality findings now have a REST API a pipeline can actually call

GitHub put its Code Quality CodeQL findings behind two read-only REST endpoints in public preview, one for listing with filtering and pagination, one for a single finding. The change turns the Code Quality UI's data into something CI/CD jobs and remediation tooling can finally consume on their own schedule.

Jun 24, 2026 · Priya Nair Platform engineering

GitHub closes its Models playground to new customers and routes new work to Azure AI Foundry

GitHub is retiring GitHub Models, its in-platform AI playground. Per DevOps.com, the feature is closed to new customers as of June 16; existing users keep playground and API access, and GitHub directs new projects to Azure AI Foundry.

Jun 19, 2026 · Maya Okonkwo Code quality & testing

GitHub Code Quality gets a GA date, and a seat inside the merge gate

GitHub has set July 20, 2026 as the general-availability date for Code Quality, a native engine that wires maintainability and reliability checks, code-coverage tracking and merge-blocking quality gates into the pull-request flow. For pipelines, the change shifts a class of checks from third-party SaaS into the same place where the merge decision lives.

Jun 17, 2026 · Maya Okonkwo