Tag

#github

Tagged “github”

17 articles

Copilot code review picks up a firewall, custom runners, and head-branch instructions

GitHub's Copilot code review can now run with a firewall, custom setup steps and independent runner configurations, and custom instructions are read from the pull request's head branch rather than the base branch.

Jul 25, 2026 · Priya Nair Security & supply chain

FakeGit floods GitHub with malicious repos aimed at coding agents

Island researchers say a campaign called FakeGit spun up about 7,600 malicious GitHub repositories, many posing as AI skills or MCP servers, to hand SmartLoader and StealC to developers and to the agents fetching capabilities on their behalf.

Jul 24, 2026 · Maya Okonkwo Platform engineering

GitHub's MCP Server tracks the stateless MCP spec, and the Redis session drops out

Ahead of a 28 July 2026 move to a stateless MCP core, GitHub says its MCP Server has been updated to run without per-session Redis state. For teams wiring coding agents into CI, that changes what the server has to remember between calls.

Jul 24, 2026 · Maya Okonkwo Code quality & testing

GitHub Code Quality goes GA, and the billing meter turns on with it

GitHub Code Quality moved to general availability on GitHub Enterprise Cloud and GitHub Team on July 20, pairing CodeQL's analysis with AI-assisted detection and Copilot Autofix inside pull requests. The pricing landed the same day: $10 per active committer per month plus usage charges for AI work and CodeQL compute.

Jul 22, 2026 · Tomás Vega Security & supply chain

Secret scanning custom patterns get a REST API, so you can PR your detectors

GitHub made REST endpoints for secret scanning custom patterns generally available on July 13, 2026. Detectors can now be created, listed, updated and deleted via API at repository, organization and enterprise scope, though dry runs and the final publish step still happen in the UI.

Jul 21, 2026 · Priya Nair Developer experience

GitHub tags AI-generated code scanning alerts on the PR itself

Code scanning now surfaces AI-powered security detections directly on pull requests, tagged next to CodeQL findings so reviewers can tell them apart. The alerts are informational and never block a merge, but they finally land where reviewers already look.

Jul 16, 2026 · Priya Nair Security & supply chain

GitHub pulls /security-review out of the CLI and into the Copilot app

GitHub's /security-review slash command is now in public preview inside the Copilot app, running a security pass on in-flight code changes before they ever reach a pull request. It is the same review that was already in the Copilot CLI, moved closer to where the code is being written.

Jul 15, 2026 · Tomás Vega Supply chain security

Dependabot learns to wait: version-update PRs now sit for three days by default

GitHub is flipping Dependabot version updates to a default three-day package cooldown. A new release has to sit on its registry for at least three days before Dependabot will open a version-update PR; security updates are exempt and still open immediately.

Jul 15, 2026 · Tomás Vega Developer experience

Autofix that reads more than one file: GitHub previews agentic code scanning fixes

GitHub's agentic autofix for code scanning alerts is in public preview, expanding remediation from the alert location out to the files around it. For CI/CD teams, a single alert now maps to a codebase-shaped change instead of a one-line patch.

Jul 14, 2026 · Priya Nair Security & supply chain

Datadog says months-long GitHub recon out of dormant 'ghost' accounts is prep for supply-chain attacks

Datadog security researchers say overlapping months-long campaigns have been abusing GitHub's public API and reactivating more than 50 long-dormant accounts to map organizations and their engineers. The setup looks a lot like the reconnaissance phase of a supply-chain intrusion.

Jul 14, 2026 · Maya Okonkwo Supply-chain security

Innersource security advisories go GA: a private channel for private vulns

GitHub Advanced Security now lets enterprise customers publish security advisories that stay inside the enterprise, and Dependabot picks them up like it would a public CVE. Useful, narrow, and only as good as the discipline behind it.

Jul 11, 2026 · Tomás Vega Security & supply chain

GitHub starts watching the whole public site for your leaked secrets

GitHub is previewing public monitoring for enterprise secret scanning: real-time detection across all of public github.com, with leaks attributed back to your organisation. Useful, and a preview, so read the small print.

Jul 6, 2026 · Tomás Vega Platform engineering

GitHub sets July 30 as the hard shutdown for GitHub Models

GitHub published a July 1 changelog entry confirming GitHub Models will be fully retired on July 30, 2026. The earlier closure to new customers now has a matching end date, and any pipeline still calling into the service has a fixed migration window of roughly four weeks.

Jul 5, 2026 · Maya Okonkwo Incident response

GitHub ships a one-click self-revoke for users whose credentials just leaked

An individual GitHub Enterprise member can now wipe every credential they own, personal access tokens, SSH keys, OAuth tokens and SSO authorizations, in a single action from the Settings page. Containment used to be a scavenger hunt across four menus.

Jun 25, 2026 · Tomás Vega Code quality & testing

Code Quality findings now have a REST API a pipeline can actually call

GitHub put its Code Quality CodeQL findings behind two read-only REST endpoints in public preview, one for listing with filtering and pagination, one for a single finding. The change turns the Code Quality UI's data into something CI/CD jobs and remediation tooling can finally consume on their own schedule.

Jun 24, 2026 · Priya Nair Platform engineering

GitHub closes its Models playground to new customers and routes new work to Azure AI Foundry

GitHub is retiring GitHub Models, its in-platform AI playground. Per DevOps.com, the feature is closed to new customers as of June 16; existing users keep playground and API access, and GitHub directs new projects to Azure AI Foundry.

Jun 19, 2026 · Maya Okonkwo Code quality & testing

GitHub Code Quality gets a GA date, and a seat inside the merge gate

GitHub has set July 20, 2026 as the general-availability date for Code Quality, a native engine that wires maintainability and reliability checks, code-coverage tracking and merge-blocking quality gates into the pull-request flow. For pipelines, the change shifts a class of checks from third-party SaaS into the same place where the merge decision lives.

Jun 17, 2026 · Maya Okonkwo