GitHub Actions holds potentially malicious workflows for approval

UpdateJul 28, 2026VerifiedAdded Sep 22, 2026

Recent supply chain attacks use compromised GitHub credentials to push malicious GitHub Actions workflows that steal CI/CD credentials and carry out additional attacks. To help protect public repositories from these attacks, GitHub Actions now holds certain workflow runs for approval before they start.

Observability Developer tools

Read GitHub's release notes

https://github.blog/changelog/2026-07-28-github-actions-holds-potentially-malicious-workflows-for-approval

Summaries of vendors' own notes. Product names and logos belong to their owners; logos via logo.dev.

More GitHub Actions releases

GitHub ActionsJul 30, 2026

Reference same-repository actions with self-repository syntax

You can now reference an action or reusable workflow that lives in the same repository using the new self-repository syntax. A uses: value that starts with $/ resolves to your workflow’s own repository at the exact commit that is running, with no checkout required.

UpdateGovernanceObservabilityDeveloper toolsSource

GitHub ActionsJul 16, 2026

Xcode 27 runner image now in public preview

You can now build and test your Apple applications against Xcode 27 on GitHub-hosted macOS runners. This is now available in public preview. With early access to the latest Xcode toolchain and Apple SDKs, you can validate your apps against the newest tools, catch compatibility issues sooner, and keep your CI/CD pipelines current.

PreviewData integrationObservabilityDeveloper toolsSource

GitHub ActionsJul 8, 2026

setup-java v5.5.0: signature verification, Kona JDK, and Maven fixes

The actions/setup-java v5.5.0 release adds cryptographic signature verification for downloaded JDKs, support for a new distribution, and several quality-of-life improvements for Maven users. Here’s what changed since v5.4.0.

UpdateObservabilitySource

GitHub ActionsAug 19, 2026

CodeQL 2.26.3 improves GitHub Actions queries and JavaScript modeling

CodeQL 2.26.3 adds JavaScript, TypeScript, and Vue source modeling and improves the accuracy of several GitHub Actions queries. CodeQL is the static analysis engine behind GitHub code scanning , which helps you find and remediate security issues in your code.

UpdateSQLSecurityDeveloper toolsSource

GitHub ActionsAug 20, 2026

Windows 11 arm64 VS2026 image generally available

The Windows 11 arm64 image with Visual Studio 2026 is now generally available on standard and larger GitHub-hosted runners. To use it in GitHub Actions, update your workflow file to runs-on: windows-11-vs2026-arm .

GAObservabilityDeveloper toolsSource

GitHub ActionsAug 20, 2026

Separate GitHub Actions path for GitHub Code Quality

A dedicated workflow path for code quality CodeQL actions workflows is now generally available. Your workflow run history and your Actions usage reports now tell GitHub Code Quality runs apart from GitHub code scanning runs.

GASecurityPricingBISource

GitHub ActionsAug 27, 2026

Actions retention will cover checks, workflow runs, and statuses

Starting October 1, 2026, checks, workflow runs, and statuses will be governed by the same Actions retention setting that already controls how long artifacts and logs are kept, with a default of 90 days. Until now, checks, workflow runs, and statuses were retained for 400+ days regardless of your retention configuration.

UpdateObservabilityDeveloper toolsSource

GitHub ActionsJun 26, 2026

Read-only Actions cache for untrusted triggers

GitHub Actions now issues read-only cache tokens to the default branch for workflow events that can be triggered without write permissions to the repository. This applies least privilege to the cache and prevents common privilege-escalation paths through cache poisoning.

UpdateSecurityDeveloper toolsSource

Also shipped on Jul 28, 2026

Snowflake SnowflakeJul 28, 2026

AI code suggestions in Workspaces (General availability)

AI code suggestions in Cortex Code are now generally available. This release also includes updated keybindings and bug fixes. Notebook Python cells , no changes to keybindings.

GANotebooksCoding agentsSource

Snowflake Snowflake Native Apps and MarketplaceJul 28, 2026

Snowflake Native Apps support for Virtual Private Snowflake on AWS for apps with containers (General availability)

Snowflake Native App with Snowpark Container Services now support Virtual Private Snowflake (VPS) on Amazon Web Services. Apps with containers can be distributed to Snowflake customers in VPS deployments. Apps running in VPS can use the functionality of Snowpark Container Services, including compute pools, services, jobs, and external access integrations.

GASource

Databricks Unity CatalogJul 28, 2026

Python UDTFs in Unity Catalog are now generally available

Registering Python user-defined table functions (UDTFs) in Unity Catalog is now generally available in Databricks Runtime 18. A Unity Catalog Python UDTF is a governed function that returns a table, invoked in the FROM clause of a SQL statement to return multiple rows and columns.

GASQLGovernanceObservabilitySource

Google Cloud AlloyDBJul 28, 2026

Note: IAM group authentication is available in Preview for new AlloyDB clusters

Note: IAM group authentication is available in Preview for new AlloyDB clusters. To enable this feature on an existing cluster, contact your Google Cloud account team. IAM group authentication for AlloyDB is available in Preview for new clusters running PostgreSQL 15 and later.

PreviewSecurityPostgresSource

Vercel Vercel platformJul 28, 2026

Vercel Connect now supports Custom Environments

Vercel Connect now lets you link a connector to a Custom Environment so deployments there can request provider tokens and receive forwarded webhooks. Custom Environments appear alongside Production, Preview, and Development when you add or edit a project on a connector in the dashboard.

PreviewPricingData integrationBISource

Palantir Foundry and AIPJul 28, 2026

AIP Document Intelligence: deploy extraction strategies as Python functions (GA)

Deploying extraction strategies to Python functions is generally available in AIP Document Intelligence, as an alternative to running a strategy in a batch pipeline.

GAData integrationSource