Read-only Actions cache for untrusted triggers GitHub Actions now issues read-only cache tokens to the default branch for workflow events that can be triggered without write permissions to the repository. This applies least privilege to the… The post Read-only Actions cache for untrusted triggers appeared first on The GitHub Blog.

setup-java v5.5.0: signature verification, Kona JDK, and Maven fixes The actions/setup-java v5.5.0 release adds cryptographic signature verification for downloaded JDKs, support for a new distribution, and several quality-of-life improvements for Maven users. Here’s what changed since v5.4.0. Verify JDK… The post setup-java v5.5.0: signature verification, Kona JDK, and Maven fixes appeared first on <a href="https://github.blog/">The GitHub...

Xcode 27 runner image now in public preview You can now build and test your Apple applications against Xcode 27 on GitHub-hosted macOS runners. This is now available in public preview. With early access to the latest Xcode… The post Xcode 27 runner image now in public preview appeared first on The GitHub Blog.

I'm trying to build a tool that gives better reporting on your github actions consumption, based on just 4 CSVs easily downloadable from GitHub. Would love some feedback if you can try it! soa.runs-on.com

GitHub Actions holds potentially malicious workflows for approval Recent supply chain attacks use compromised GitHub credentials to push malicious GitHub Actions workflows that steal CI/CD credentials and carry out additional attacks. To help protect public repositories from these… The post GitHub Actions holds potentially malicious workflows for approval appeared first on The GitHub Blog.

Reference same-repository actions with self-repository syntax You can now reference an action or reusable workflow that lives in the same repository using the new self-repository syntax. A uses: value that starts with $/ resolves to your… The post Reference same-repository actions with self-repository syntax appeared first on The GitHub Blog.

Separate GitHub Actions path for GitHub Code Quality A dedicated workflow path for code quality CodeQL actions workflows is now generally available. Your workflow run history and your Actions usage reports now tell GitHub Code Quality runs apart… The post Separate GitHub Actions path for GitHub Code Quality appeared first on The GitHub Blog.

Windows 11 arm64 VS2026 image generally available The Windows 11 arm64 image with Visual Studio 2026 is now generally available on standard and larger GitHub-hosted runners. To use it in GitHub Actions, update your workflow file to… The post Windows 11 arm64 VS2026 image generally available appeared first on The GitHub Blog.

Hi, trying to run large number of stacks via

cloudposse/github-action-matrix-extended

action. It seems that input for the inner action that's called by it, i.e.

cloudposse/github-action-jq

is too long. I'm getting:

An error occurred trying to start process '/home/runner/actions-runner/cached/2.336.0/externals/node24/bin/node' with working directory '/home/runner/work/infra-github/infra-github'. Argument list too long

It's 136,054 bytes long. Is this anything you've faced before?

Actions retention will cover checks, workflow runs, and statuses Starting October 1, 2026, checks, workflow runs, and statuses will be governed by the same Actions retention setting that already controls how long artifacts and logs are kept, with a… The post Actions retention will cover checks, workflow runs, and statuses appeared first on The GitHub Blog.

GitHub Actions: Early September 2026 updates GitHub Actions now includes three updates that give you clearer visibility and finer-grained control over your workflows. New REST API for runner version deprecations A new REST API returns when… The post GitHub Actions: Early September 2026 updates appeared first on The GitHub Blog.

Xcode 27 runner image now runs on macOS 27 You can now validate your Apple apps against macOS 27 using the Xcode 27 runner image for GitHub-hosted macOS runners, available in public preview. The image previously ran on macOS… The post Xcode 27 runner image now runs on macOS 27 appeared first on The GitHub Blog.

Control GitHub Actions cache access with cache-mode You can now use cache-mode to apply least-privilege access to the GitHub Actions cache at the workflow or job level. By granting each workflow or job only the cache access… The post Control GitHub Actions cache access with cache-mode appeared first on The GitHub Blog.

Ubuntu 26 generally available and latest migration The Ubuntu 26.04 runner image for GitHub Actions is now out of public preview and fully supported for production workflows on both x64 and arm64. As part of this release,… The post Ubuntu 26 generally available and latest migration appeared first on The GitHub Blog.

Node 20 is no longer available in GitHub Actions This is the final notification that Node 20 is no longer available on GitHub Actions runners. Runners now use Node 24 for JavaScript actions. The temporary ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out is no… The post Node 20 is no longer available in GitHub Actions appeared first on The GitHub Blog.

Expired GitHub Actions artifacts no longer shown in UI and API Expired artifacts are no longer displayed in the GitHub Actions run summary or returned by the REST API. Previously, an expired artifact remained visible with an “Expired” pill, even though… The post Expired GitHub Actions artifacts no longer shown in UI and API appeared first on The GitHub Blog.

Changes to query results in the GitHub Actions API and UI Queries for workflow runs in the GitHub Actions API and UI now return a less precise but more accurate count of records when you search by workflow, event, status, branch,… The post Changes to query results in the GitHub Actions API and UI appeared first on The GitHub Blog.

Self-hosted runner version enforcement date has moved The enforcement date for GitHub Actions minimum version requirements for self-hosted runners on GitHub Enterprise Cloud has changed. The change ships Monday, September 28, 2026, and full enforcement now begins… The post Self-hosted runner version enforcement date has moved appeared first on The GitHub Blog.

I’m researching how teams handle several PRs that are individually green but need to ship together. How do you validate merge order, interactions between changes and affected tests without repeatedly running the full CI suite? I’ be interested in how teams with high PR throughput approach this.

Actions Runner Controller release 0.15.0 GitHub Actions Runner Controller 0.15.0 includes reliability, scalability, and observability improvements for runner scale sets. These updates help you operate larger runner fleets with fewer disruptions during upgrades and Kubernetes… The post Actions Runner Controller release 0.15.0 appeared first on The GitHub Blog.

Actions retention now covers checks, runs, and statuses As previously announced, checks, workflow runs, and statuses are now governed by the same GitHub Actions retention setting that controls how long artifacts and logs are kept. These records are… The post Actions retention now covers checks, runs, and statuses appeared first on The GitHub Blog.

GitHub Actions: macOS 14 runner image retirement The macOS 14 runner image will be retired on November 2, 2026. To raise awareness of the upcoming removal, jobs using macOS 14 will temporarily fail during the following scheduled… The post GitHub Actions: macOS 14 runner image retirement appeared first on The GitHub Blog.

Stateless GitHub App installation tokens rolled out The staged rollout of the stateless GitHub App installation token format, which began on April 27, 2026, is complete. By default, all newly minted GitHub App installation tokens will be… The post Stateless GitHub App installation tokens rolled out appeared first on The GitHub Blog.

GitHub Actions workflow lockfiles in public preview GitHub Actions workflow dependency lockfiles are now in public preview for GitHub Enterprise Cloud and GitHub Enterprise Cloud with data residency. Tags and branches can move after you review a… The post GitHub Actions workflow lockfiles in public preview appeared first on The GitHub Blog.

Xcode 27 runner image generally available You can now use the generally available Xcode 27 runner image to build and test your Apple applications in GitHub Actions. Previously in public preview, this GitHub-hosted image runs on… The post Xcode 27 runner image generally available appeared first on The GitHub Blog.

Meta API endpoints updated for Actions blob storage We’re adding blob storage endpoints for GitHub Actions on github.com as part of our ongoing work to improve capacity and reliability. The meta API now includes these new endpoints. If… The post Meta API endpoints updated for Actions blob storage appeared first on The GitHub Blog.

GitHub Actions workflow lockfiles are generally available You can now use GitHub Actions workflow dependency lockfiles in general availability on GitHub Enterprise Cloud, GitHub Enterprise Cloud with data residency, Team, and Free plans. Lockfiles let you keep… The post GitHub Actions workflow lockfiles are generally available appeared first on The GitHub Blog.

GitHub Actions adds multi-cloud compute to improve reliability We’re expanding the infrastructure behind GitHub-hosted runners so your workflows start faster and run more reliably, even during periods of peak demand. GitHub Actions now schedules eligible jobs across a… The post GitHub Actions adds multi-cloud compute to improve reliability appeared first on The GitHub Blog.

GitHub Agentic Workflows generally available GitHub Agentic Workflows, an open source project from GitHub Next, is now generally available. With agentic workflows, you can automate reasoning-based tasks like issue triage, CI failure analysis, documentation updates,… The post GitHub Agentic Workflows generally available appeared first on The GitHub Blog.

pull_request_target blocked by default December 2 Starting December 2, 2026, GitHub Actions will block pull_request_target events by default in all public repositories, unless an applicable Actions event policy explicitly allows them. Enforcement was previously scheduled for… The post pull_request_target blocked by default December 2 appeared first on The GitHub Blog.