tag: Github-Actions · 47 items
- Platform/SRE — Learn: GA automation for issue triage and CI failure analysis could reduce toil on shared infra, but there’s no operational urgency or infrastructure surface change — worth watching as the tooling matures.
- CI/CD — Plan: Now GA, GitHub Agentic Workflows can automate CI failure analysis and triage directly in the pipeline; evaluate adopting it this quarter to reduce manual investigation overhead across teams.
- Leader — Learn: A new GA open-source automation layer from GitHub Next that could eventually inform the org’s golden path for AI-assisted DevOps, but no licensing, cost, or strategic decision is required yet.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Plan: If your runners operate behind strict outbound firewall or IP allowlist rules, review and update allowlists to include the new GitHub Actions blob storage endpoints surfaced in the meta API — no deadline given, but unpatched allowlists could silently break artifact uploads or caching.
- Leader — Skip
- Platform/SRE — Plan: This open-source module automates ephemeral, auto-scaling GitHub Actions runner fleets on AWS via Terraform — worth evaluating if the org self-hosts runners on EKS or EC2 and wants to reduce idle capacity costs.
- CI/CD — Plan: Teams running self-hosted GitHub Actions runners on AWS should evaluate this module to gain on-demand ephemeral runners and eliminate persistent runner maintenance overhead; no deadline, but a useful near-term adoption candidate.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: Teams running CodeQL on Swift projects will need to update their scanning configuration when adopting macOS 27 or Xcode 27 runners, as Apple has removed Intel x86_64 code from system binaries CodeQL depends on for build tracing. No forced deadline, but plan this alongside any macOS 27 runner migration.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: The Xcode 27 hosted runner is now GA on GitHub Actions after public preview; if your team builds or tests Apple platform apps, schedule adoption to stay on current toolchain and avoid future runner deprecations.
- Leader — Skip
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Plan: GitHub’s AI Scan for PRs is now GA, extending code vulnerability detection to languages and frameworks CodeQL doesn’t cover — evaluate enabling it in your GitHub Actions workflows this quarter to broaden supply-chain security coverage.
- Leader — Plan: GA availability makes this worth adding to your security standards: assess whether to mandate AI Scan alongside CodeQL as part of the org’s golden-path security policy for pull requests.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Plan: This GA feature can automatically remediate code scanning alerts within your GitHub workflows, reducing manual triage burden. Evaluate enabling it on repositories that use GitHub Advanced Security to tighten the security feedback loop in your pipelines.
- Leader — Learn: GitHub’s agentic autofix moves automated security remediation from a developer convenience into a pipeline-integrated capability, which could reshape how teams handle vulnerability backlog — worth tracking as AI-driven developer tooling matures, but no immediate strategic decision is required.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Learn: Workflow lockfiles for GitHub Enterprise Cloud will help pin action versions to prevent silent drift — worth evaluating once GA, but pre-GA preview status caps this at Learn for now.
- Leader — Skip
- Signals: pre-GA (alpha/beta/RC/preview)
- Platform/SRE — Skip
- CI/CD — Plan: If your org runs internal package mirrors accessible without credentials, configure the new Anonymous auth method at the org level to simplify Dependabot registry setup and reduce credential management overhead.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: GitHub org/enterprise admins can now see which repos have AI Scan for PRs enabled in the security overview — useful context when auditing pipeline security coverage, but no pipeline change required.
- Leader — Learn: This visibility feature lets platform leaders quickly assess AI-assisted code scanning adoption across repos, supporting supply-chain security posture reviews at the org or enterprise level.
- Platform/SRE — Skip
- CI/CD — Plan: Checks, workflow runs, and commit statuses are now subject to the same retention window as artifacts and logs. Audit your Actions retention setting to confirm build history is kept long enough to satisfy any compliance or audit trail requirements.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Act: Any pipeline referencing the macOS 14 runner label will fail when GitHub begins pre-retirement disruption runs, then permanently break on November 2, 2026. Audit all workflow files and replace ‘macos-14’ with ‘macos-15’ (or another supported image) before that date.
- Leader — Skip
- Signals: deprecation/EOL deadline mentioned: November 2, 2026
- Platform/SRE — Skip
- CI/CD — Learn: The GitHub upload-code-coverage action previously errored on branches with no open PR; that behavior is now fixed automatically with no pipeline changes required on your end.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: GitHub’s scheduled code scanning now requires a prior push or PR to activate weekly scans, which may silently drop coverage on dormant repos; review which repos rely on scheduled-only scanning to avoid gaps.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: The GA async merge API enables programmatic merge queue management and stacked PR workflows; evaluate adopting it to automate release orchestration or replace custom merge scripts.
- Leader — Skip
- Signals: GA announcement
- Platform/SRE — Plan: ARC runs on Kubernetes clusters you operate; the 0.15.0 improvements to runner scale-set reliability during cluster upgrades are worth evaluating and scheduling for adoption this quarter. No deadline or security fix in the signals.
- CI/CD — Plan: If you operate self-hosted GitHub Actions runners via ARC, 0.15.0 brings reliability and observability gains for large runner fleets — worth scheduling an upgrade to reduce disruption during runner or cluster maintenance windows.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: New GA GitHub capability lets repository admins route Dependabot version and security update jobs to specific runner types, labels, or groups; worth evaluating if your org uses self-hosted runners and needs network isolation or resource controls for dependency update jobs.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: Interesting pattern for teams still running Docker Compose over SSH: health-checked rollout with automatic rollback and a migrations hook baked in as a plain-Bash GitHub Action; worth bookmarking if you support non-Kubernetes deployment targets, but no deadline or adoption pressure.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Act: Minimum version enforcement for self-hosted runners on GitHub Enterprise Cloud took effect September 28, 2026; audit all self-hosted runner instances immediately and upgrade any falling below the new minimum version to prevent pipeline failures across every team using them.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: Workflow run count queries in the GitHub Actions API and UI now return approximate rather than exact counts; worth reviewing if your pipelines or dashboards rely on precise record counts from these endpoints.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: Expired artifacts no longer appear in the Actions run summary or via the REST API; any automation or scripts that queried the artifacts API and expected expired entries to be present may silently return fewer results — worth auditing artifact-listing logic.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Act: Node 20 is already gone from GitHub Actions runners and the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION escape hatch is also removed, meaning any JavaScript actions still targeting Node 20 are broken now. Audit all JavaScript actions in your pipelines and update them to Node 24 compatibility immediately.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: GitHub’s REST API now exposes the code-coverage repository ruleset condition that was previously UI-only; useful context if you’re automating ruleset management via IaC or scripts, but no migration or deadline required.
- Leader — Skip
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Plan: ubuntu-latest will migrate to Ubuntu 26.04, which can silently change pre-installed toolchain versions and break pipelines; audit workflows using ubuntu-latest and validate against ubuntu-26.04 before the cutover date GitHub publishes.
- Leader — Skip
- Signals: Ubuntu 26.04 EOL 2031-05-29 · GA announcement
- Platform/SRE — Skip
- CI/CD — Plan: Workflow execution protections are now GA for GitHub Enterprise, orgs, and repos; schedule adoption of allowlist controls to restrict who can trigger workflows as a supply-chain hardening step this quarter.
- Leader — Plan: This GA feature enables org-wide policy on who may trigger GitHub Actions workflows; evaluate adding it to your golden-path security standards and internal developer platform requirements.
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Learn: AI Scan can now be enabled on repos that haven’t configured CodeQL default setup, lowering the barrier to adding automated security scanning to pull request workflows — worth revisiting if teams have been blocked on CodeQL prerequisites.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: macOS 27 / Xcode 27 runner is in public preview — worth noting for teams with Apple app pipelines, but pre-GA status caps this at Learn with no action yet.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: Public preview API for programmatic control of GitHub’s AI code scanning on PRs — worth tracking for future pipeline integration, but not actionable until GA.
- Leader — Skip
- Signals: pre-GA (alpha/beta/RC/preview)
- Platform/SRE — Skip
- CI/CD — Plan: New GA GitHub Actions feature lets you scope cache read/write permissions per workflow or job, reducing blast radius of a compromised workflow. Evaluate and adopt cache-mode across pipelines this quarter as a supply-chain hardening step.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: The new REST API surfacing runner version deprecations lets you proactively query upcoming retirements before they silently red-line pipelines. Integrate it into pipeline monitoring this quarter; no hard date was found in the signals, so this is a scheduled improvement rather than an emergency.
- Leader — Skip
- Signals: deprecation mentioned (no explicit date found)
- Platform/SRE — Skip
- CI/CD — Learn: Copilot can now be authorized to formally approve PRs, which could change how teams gate merges; worth evaluating if the org uses GitHub and wants to automate lightweight review sign-off.
- Leader — Learn: AI-assisted PR approval is a governance and standards question — assess whether org policy should permit or restrict automated approvals before teams opt in independently.
- Platform/SRE — Skip
- CI/CD — Plan: Starting October 1, 2026, GitHub Actions retention settings will also govern checks, workflow runs, and commit statuses — review your current retention configuration to ensure historical build data and compliance audit trails are preserved as expected before the change takes effect.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: Demonstrates a pattern for running isolated AI agents inside GitHub Actions using Docker Sandboxes; worth evaluating as an emerging CI workflow design, but no concrete migration or deadline exists.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: The Windows 11 arm64 VS2026 runner image is now GA on GitHub-hosted runners; teams building Windows arm64 artifacts should evaluate updating workflow
runs-onlabels to adopt the new image this quarter. - Leader — Skip
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Plan: If you use CodeQL in GitHub Actions, evaluate adopting the new dedicated workflow path to improve run-history clarity and accurate usage reporting — no deadline, but worth scheduling as routine pipeline hygiene.
- Leader — Skip
- Signals: GA announcement
- Platform/SRE — Skip
- CI/CD — Plan: If your org uses GitHub code scanning default setup, evaluate adopting the new github-codeql-config-file repository property to standardize CodeQL scan behavior across repos without per-repo overrides.
- Leader — Plan: This enables centralized enforcement of code scanning standards across the org’s repositories — worth incorporating into the golden path or security policy for teams already on GitHub Advanced Security.
- Platform/SRE — Skip
- CI/CD — Learn: GitHub now offers AI-generated coverage workflow setup from repository Code Quality settings, reducing onboarding friction; worth evaluating if teams struggle to bootstrap coverage, but no pipeline migration is required.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: GitHub now holds potentially malicious workflow runs for review in public repositories; audit your org’s Actions approval settings and ensure maintainers understand how to review held runs before merging external contributions.
- Leader — Learn: GitHub’s new default protection against credential-stealing workflow attacks reduces supply-chain risk for orgs using public repos; worth noting as a positive vendor-risk signal when assessing GitHub Actions dependency.
- Platform/SRE — Skip
- CI/CD — Learn: CodeQL 2.26.1 brings improved framework coverage for Go and better analysis accuracy; worth noting if you run GitHub code scanning in pipelines, but this is a patch-level quality improvement with no breaking changes or deadline.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: GitHub now holds unproven workflows pending approval on public repos — review your repository settings and approval workflows to ensure this protection is enabled and fits your release process.
- Leader — Learn: A new GitHub platform-level control targeting supply chain attacks via compromised credentials; worth noting as a defense-in-depth signal for orgs that rely on GitHub Actions for public repositories.
- Platform/SRE — Skip
- CI/CD — Learn: This adds a mobile-first workflow for diagnosing and fixing failed Actions checks via Copilot agent; no pipeline changes required, but worth tracking as an AI-assisted DevEx pattern for CI triage.
- Leader — Skip
- Platform/SRE — Learn: A community module for self-hosted GitHub Actions runner autoscaling on AWS; worth evaluating if teams are self-hosting runners, but no deadline or GA milestone signals a required change.
- CI/CD — Plan: If cost or throughput is a pain point with GitHub-hosted runners, this Terraform module offers a path to autoscaled self-hosted runners on AWS — worth scheduling an evaluation this quarter.
- Leader — Skip
- Platform/SRE — Plan: If your pipelines use pulumi/actions or pulumi/action-install-pulumi-cli, both have major version bumps (v6→v7, v1→v2) that likely include breaking changes; audit your workflow files and update action refs this quarter.
- CI/CD — Plan: pulumi/actions jumped v6→v7 and pulumi/action-install-pulumi-cli jumped v1→v2 — major bumps that may break existing pipeline steps; review release notes for both actions and update workflow references before Renovate auto-merges cause unexpected failures.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Learn: Public preview of the Xcode 27 macOS runner is available for early testing; pre-GA status caps this at Learn — evaluate in a non-production pipeline before GA.
- Leader — Skip
- Signals: pre-GA (alpha/beta/RC/preview)
- Platform/SRE — Skip
- CI/CD — Plan: GitHub’s AI-powered security detections now surface on PRs for languages CodeQL doesn’t cover — worth enabling to broaden supply-chain and vulnerability coverage in existing GitHub Actions workflows.
- Leader — Learn: Expanded AI security coverage on PRs broadens GitHub’s appeal as a unified code-security platform, relevant if evaluating whether GitHub Advanced Security covers the org’s language portfolio.
- Platform/SRE — Skip
- CI/CD — Learn: Dependabot’s new default 3-day cooldown before raising version-update PRs reduces noise from yanked or quickly-patched releases; no pipeline changes required, but worth understanding if teams rely on same-day dependency PRs.
- Leader — Skip
- Platform/SRE — Skip
- CI/CD — Plan: If pipelines run CodeQL scanning on Kotlin 2.4.0 codebases, upgrade to CodeQL 2.26.0 this quarter to maintain scan coverage; the new AI prompt injection queries are worth enabling if building LLM-integrated apps.
- Leader — Skip