Workflow execution protections in GitHub Actions generally available

GASep 17, 2026VerifiedAdded Sep 22, 2026

Workflow execution protections for GitHub Actions, previously in public preview, are now generally available for GitHub Enterprise, organizations, and repositories. Execution protections let you define an allowlist that controls who can trigger an Actions workflow and what events can start it.

Governance Developer tools

Read GitHub's release notes

https://github.blog/changelog/2026-09-17-workflow-execution-protections-in-github-actions-generally-available

Summaries of vendors' own notes. Product names and logos belong to their owners; logos via logo.dev.

More GitHub Actions releases

GitHub ActionsSep 17, 2026

Ubuntu 26 generally available and latest migration

The Ubuntu 26.04 runner image for GitHub Actions is now out of public preview and fully supported for production workflows on both x64 and arm64. As part of this release, the ubuntu-latest label will migrate to Ubuntu 26.04, giving you the latest supported Ubuntu release by default.

GADeveloper toolsSource

GitHub ActionsSep 23, 2026

Node 20 is no longer available in GitHub Actions

This is the final notification that Node 20 is no longer available on GitHub Actions runners. Runners now use Node 24 for JavaScript actions. The temporary ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out is no longer available. If you maintain a JavaScript action, update its runs.using value to node24 and publish a new release as soon as possible.

DeprecationUnverifiedObservabilityDeveloper toolsSource

GitHub ActionsSep 10, 2026

Control GitHub Actions cache access with cache-mode

You can now use cache-mode to apply least-privilege access to the GitHub Actions cache at the workflow or job level. By granting each workflow or job only the cache access it needs, you can prevent unnecessary restores or saves and help protect trusted workflows from cache poisoning. This capability is now generally available on all plans.

GAPricingDeveloper toolsSource

GitHub ActionsSep 10, 2026

Xcode 27 runner image now runs on macOS 27

You can now validate your Apple apps against macOS 27 using the Xcode 27 runner image for GitHub-hosted macOS runners, available in public preview. The image previously ran on macOS 26. How you target the image stays the same.

PreviewObservabilitySource

GitHub ActionsSep 3, 2026

GitHub Actions: Early September 2026 updates

GitHub Actions now includes three updates that give you clearer visibility and finer-grained control over your workflows. New REST API for runner version deprecations A new REST API returns when registration and runtime support end for a given runner version, so you can plan runner upgrades before a version is deprecated.

UpdateSecurityPricingDeveloper toolsSource

GitHub ActionsSep 3, 2026

CodeQL 2.26.4 improves GitHub actions security detections

CodeQL is the static analysis engine behind GitHub code scanning, which finds and remediates security issues in your code. We’ve recently released CodeQL 2.26.4 , which adds support for Go 1.27, improves alert locations for Rust data flow queries, and includes accuracy improvements across C#, Java/Kotlin, and GitHub Actions.

UpdateSQLSecurityDeveloper toolsSource

GitHub ActionsAug 27, 2026

Actions retention will cover checks, workflow runs, and statuses

Starting October 1, 2026, checks, workflow runs, and statuses will be governed by the same Actions retention setting that already controls how long artifacts and logs are kept, with a default of 90 days. Until now, checks, workflow runs, and statuses were retained for 400+ days regardless of your retention configuration.

UpdateObservabilityDeveloper toolsSource

GitHub ActionsAug 20, 2026

Windows 11 arm64 VS2026 image generally available

The Windows 11 arm64 image with Visual Studio 2026 is now generally available on standard and larger GitHub-hosted runners. To use it in GitHub Actions, update your workflow file to runs-on: windows-11-vs2026-arm .

GAObservabilityDeveloper toolsSource

Also shipped on Sep 17, 2026

Google Cloud BigQuerySep 17, 2026

You can add unit tests to pipelines to validate your SQL transformation logic against mock datasets

You can add unit tests to pipelines to validate your SQL transformation logic against mock datasets. Unit tests for pipelines are generally available (GA).

GASQLData integrationSource

Databricks Unity CatalogSep 17, 2026

Metastore-level ABAC policies are in Beta

Metastore-level ABAC policies are in Beta in Unity Catalog. You can now attach an ABAC policy (row filter, column mask, GRANT, or DENY) at the metastore level, so a single policy applies across every catalog in the metastore, including catalogs created later.

BetaGovernanceObservabilityDeveloper toolsSource

Databricks Databricks Data Intelligence PlatformSep 17, 2026

Moonshot AI Kimi K2.7 is scheduled for retirement

Moonshot AI Kimi K2.7 will be retired on October 30, 2026. Kimi K3 is the recommended replacement. See Deprecated and retired models for migration guidance.

DeprecationSource

Snowflake SnowflakeSep 17, 2026

HTML generation in Snowflake CoWork (Preview)

HTML generation is now available in preview as part of document generation in Snowflake CoWork. You can ask Snowflake CoWork to generate an HTML file from your analysis, the same way you generate a PDF or PowerPoint. Generation requires the Cortex Agent code execution tool on the associated agent.

PreviewAI agentsSource

Databricks Databricks Data Intelligence PlatformSep 17, 2026

Base environments are now supported on classic compute (Beta)

You can now use base environments to manage Python dependencies on classic compute. You can use Databricks-provided environments or custom workspace-level environments. See Manage dependencies using environments .

BetaSource

Snowflake Snowflake Native Apps and MarketplaceSep 17, 2026

Snowpark Container Services backup instance types (General availability)

Backup instance types for Snowpark Container Services compute pools are now generally available and are no longer in Preview .

GASource