Ben De St Paer-Gotch

github.blog/changelog/2026… #whats-not-changing-or-covered" target="_blank" rel="nofollow noopener">github.blog/changelog/2026… github.blog/changelog/2026…

🔒 Raising the bar on Actions security. It is no secret that a lot of supply chain attacks over the last 9 months have started in the Actions ecosystem. Attackers have taken advantages of behaviours which historically we saw as 'dangerous but unexploited'; the world has changed and Actions needs to start changing with it. 1. actions/checkout now refuses to fetch fork pull request code in pull_request_target and workflow_run workflows (the latter only when workflow_run.event is a pull_request* event) 2. Cache is now Read-only for untrusted triggers 3. Control who and what triggers GitHub Actions workflows with Actions policies That's the ships in the last two weeks. We aren't even close to done raising the bar here and will keep going until we have burned down the current risk and made the world that bit safer to work in More to come ❤️

@JakeArkinstall @kdaigle What would you like to see for the Glibc version from Actions? 🤔

@JakeArkinstall @kdaigle But Actions is at a point of adoption vs the friction of change for other folks. One thing we have looked at is seeing if we could make other languages something the community could drive. It is genuinely on the backlog to look at but we know we have a bunch of other pain fix

Yup, platform activity is surging. There were 1 billion commits in 2025. Now, it's 275 million per week, on pace for 14 billion this year if growth remains linear (spoiler: it won't.) GitHub Actions has grown from 500M minutes/week in 2023 to 1B minutes/week in 2025, and now 2.1B minutes so far this week. So we're pushing incredibly hard on more CPUs, scaling services, and strengthening GitHub’s core features. And as a fine purveyor of hand-crafted shit code for many years, I'm not gonna weigh in on that. 🤣

@grhmc @martinwoodward What client/SDK are you using? From datatracker.ietf.org/doc/html/rfc75… you can have the same key twice 🤔 It's called a key "set", implying there can be multiple. I think it is just because the rotation has never happened hmm I will need to follow up more tomorrow <3

@Nebuk89 @martinwoodward This is because you can’t make an AWS oidc provider if the provider’s url is unavailable. This was just a one time thing we worked around with terraform. The duplicate key is more important to me 😅

@martinwoodward could you help get this little GHES bug fixed? It should be real easy 🙏 github.com/ramosbugs/open…

@charliermarsh Looking forward to reading it <3 let me know if you have thoughts on what we should be building beyond what we have coming: github.blog/news-insights/… And if you want to chat through Actions & security let me know!

We're planning to write a post about everything we do / recommend here

@tomlparser We have handled this issue. "Run Cancelled" notifications have been suppressed when Only notify for failed workflows is selected. They will appear when this option is unselected. #discussioncomment-16052811" target="_blank" rel="nofollow noopener">github.com/orgs/community…

@Nebuk89 Day 1,463 of asking to be able to suppress Run cancelled notifications #discussion-3946612" target="_blank" rel="nofollow noopener">github.com/orgs/community…

Two of the top GitHub Actions community requests are now live 1. Timezone support in crons schedule: - cron '30 5 * * 1-5' timezone: "America/New_York" 2. Use environments without auto-deployments environment: name: staging deployment: false

See more about recent ships in the changelog github.blog/changelog/2026…

We're continuing to ship top community requests and also just added multi-label on ARC. There's a lot more coming → Parallel steps → Splitting out composite steps → Improving concurrency to not cancel pending jobs

Releasing should also be as easy as pushing a button. *Everything* should be wrapped up into a GitHub workflow. Triggered manually, if you want. No remembering anything, and certainly no relying on my specific machine to cut a release!

Issue fields are now in preview! Request access for your org in GitHub Discussions 👇

Issue Forms just got better! You can now let people upload files as they open an issue.

@SerjAgopian Yah.. the existing dashboards just don't do it. For now we are going to do a data stream (like the audit log) but with 'anything you have ever wanted to know about Actions' so folks can at least self serve this without a billion API requests

@Nebuk89 Would be amazing to have an observability dashboard where you can see the performance of all steps/workflows out of the box. Alerts on top would be a cherry on top.

Spending lots of time with customers sharing what’s next in GitHub Actions. A peek: Doubling down on availability Lock files (spec WIP) Parallel steps (spec is public) Artifacts in UI coming next week Also coming is: Splitting out composite Actions Environments without deploy

@chlvrstwrs Folders - agree. We are doing foundation work now. Conditions - looking at more <3 GH unique names... I want this badly (biased... lol) it's on the list, though I have no time for this one Cert storage - interesting, not one I have heard a lot. If you have a write up somewhere 👀

@chlvrstwrs Parallel steps we jumped in :) #discussioncomment-15480826" target="_blank" rel="nofollow noopener">github.com/orgs/community… And folders <3 yep. Heard loud and clear along with better filtering. We want to do some policies work first to unblock doing this better. We will do a blog on upcoming policies work in the next week or two

@davidfowl Yep - on it. This is DAP so we can do this with a local DAP MCP server and this already works <3 we have a demo of this going as well

@Nebuk89 Very cool! Make it usable with copilot CLI so I don't need to open VS code at all :)

Also engineering demo's this week were awesome. Super excited for this to come to life over the next couple of months to make Actions debugging that bit better.

@ConnorStorer This is.. 2-3 weeks out.

@Nebuk89 Environments without deploy PLEASE