scm ci

GitHub Actions: security advisories, deprecations and releases

GitHub's CI/CD and automation workflows.

Get GitHub Actions alerts Free. No account. One email, and only when something touches your stack.

What your digest would have held this week

2 items from the last 7 days. Zero sends only the ones that touch your stack.

HIGH NEW THIS WEEK ACT BY 2 DEC 2026 GitHub Changelog · 2 Nov 2026

pull_request_target blocked by default December 2

GitHub Actions will block pull_request_target by default in public repos from Dec 2 2026 to reduce secret theft risk from forks. Two brownout windows precede enforcement.
HIGH Wiz Blog · 26 Oct 2026

The Pwn Request Reckoning: What Still Works Against GitHub Actions

GitHub's 2026 Actions changes reduce pull_request_target attack risks, but residual attack surface remains and needs auditing.

HIGH ACT BY 2 NOV 2026 GitHub Changelog · 2 Oct 2026

GitHub Actions: macOS 14 runner image retirement

macOS 14 runner images will be permanently retired on November 2, 2026. Scheduled brownouts will cause jobs using these images to fail during October 2026.

MEDIUM GitHub Changelog · 23 Oct 2026

Meta API endpoints updated for Actions blob storage

GitHub added new blob storage endpoints to the meta API for GitHub Actions. Organizations using network allowlists must update firewall rules to include new Azure blob storage hosts.
MEDIUM ACT BY 14 OCT 2026 GitHub Changelog · 14 Oct 2026

GitHub Actions workflow lockfiles now in public preview

GitHub Actions now supports workflow dependency lockfiles that pin actions and reusable workflows to specific commits, preventing tag or branch movement from introducing unexpected code.
INFO GitHub Changelog · 3 Oct 2026

Actions retention now covers checks, runs, and statuses

Checks, workflow runs, and statuses are now governed by the existing GitHub Actions retention setting that also controls artifacts and logs.

INFO NEW THIS WEEK ACT BY 21 OCT 2026 CNCF Blog · 31 Oct 2026

Distributed tracing for CI pipelines without touching a single workflow file

GitHub Actions observability can be gained org-wide by listening to workflow_run and workflow_job events via an OpenTelemetry Collector githubreceiver instead of modifying every workflow file.

Tell Zero what you run. You get one email, and only on the days something above applies to you.