On 14 October 2026, GitHub opened workflow lockfiles to public preview: every action and reusable workflow is pinned to a specific commit, so the code you reviewed is the code that runs. Turn on locking for your critical repositories before a moved tag slips malicious code into your CI.

On September 3, 2026, GitHub shipped three GitHub Actions updates: a vulnerability-alerts permission for GITHUB_TOKEN, the job context for reusable workflows, and a runner deprecation API. Swap your broad scopes for the vulnerability-alerts permission and adopt job.workflow_ref in your reusable workflows.

In early August 2026, GitHub shipped a vulnerability-alerts: read permission that lets the CI token query Dependabot alerts without an over-privileged PAT. Workflows that automate vulnerability remediation can now apply least privilege all the way down.