On October 22, 2026, Vercel declared static credentials dead after surveying more than 1,000 SaaS vendors and finding only 8.4% support OIDC authentication. Two Marketplace deadlines are now set, yet Vercel’s official GitHub Actions deployment guide still requires a long-lived token.
On 14 October 2026, GitHub opened workflow lockfiles to public preview: every action and reusable workflow is pinned to a specific commit, so the code you reviewed is the code that runs. Turn on locking for your critical repositories before a moved tag slips malicious code into your CI.
The GhostAction campaign compromises maintainer accounts to push a fake “security” workflow that exfiltrates CI/CD secrets to an attacker-controlled IP. Check your repos for security-audit.yml and github_actions_security.yml, then revoke any affected credentials.
GitHub will retire the macOS 14 runner image on November 2, 2026 and is already failing jobs that still use it during eight brownout windows spread across October. Migrate your workflows to an arm64 label — macos-15 or macos-latest — before the next outage on October 12.
On 17 September 2026 GitHub announced that the ubuntu-latest label is moving from Ubuntu 24.04 to 26.04, rolling out gradually between 19 October and 19 November 2026. The migration ships a JDK jump from 17 to 25, major-version bumps for Docker Compose and Helm, and the removal of a dozen preinstalled tools: workflows that don’t pin their runtime will break.
The actions-cool/issues-helper and maintain-one-comment actions, compromised on 18 May 2026 in the Mini Shai-Hulud campaign, were re-enabled on 16 September with tags still pointing at malicious code, according to Socket. The lesson is blunt: in CI/CD, a mutable tag is a door left open.
GitHub has tightened minimum-version enforcement for self-hosted runners: brownouts began September 14, and from September 25, 2026 any runner not updated within 30 days stops receiving jobs. The failure is silent — jobs sit in “Queued” with no error: audit your runners before the next window.
On September 3, 2026, GitHub shipped three GitHub Actions updates: a vulnerability-alerts permission for GITHUB_TOKEN, the job context for reusable workflows, and a runner deprecation API. Swap your broad scopes for the vulnerability-alerts permission and adopt job.workflow_ref in your reusable workflows.
After the tag-repositioning attacks that hit tj-actions and 23,000 repositories, GitHub is rolling out a security roadmap for Actions: dependency lockfiles, scoped secrets, and an egress firewall. Two measures are available today: SHA pinning and OIDC.
From 1 October 2026, GitHub applies the same retention setting to checks, workflow runs and statuses that already governs artifacts and logs — 90 days by default instead of more than 400. Teams that rely on that history must review their setting and export what they want to keep.
In early August 2026, GitHub shipped a vulnerability-alerts: read permission that lets the CI token query Dependabot alerts without an over-privileged PAT. Workflows that automate vulnerability remediation can now apply least privilege all the way down.
Docker Hub now supports OpenID Connect for GitHub Actions. Workflows authenticate with short-lived, per-run tokens instead of storing PATs or OATs in GitHub secrets. Manual credential rotation is officially obsolete.
As of August 1, 2026, GitHub automatically generates SLSA Build Level 3 attestations for every Actions workflow run on a public repository. The software supply chain becomes verifiable without effort — and regulatory compliance follows.
Custom runner images hit general availability on March 26, 2026 after a six-month public preview. They eliminate per-job setup and speed up pipelines — but shift image maintenance, security patching, and versioning squarely onto your team.
