Scheduled code scanning skips inactive repositories

GitHub has expanded its advisory GraphQL interface with CVE identifiers, affected source-code links, GitHub review dates, NVD publication dates and links to associated repository advisories. New severity and withdrawal filters let integrations narrow results before downloading them. GitHub says the additions reduce the need to switch to REST for advisory data; they are read-only changes that preserve existing queries.

GitHub will remove its macOS 14 Actions runner images on November 2, 2026, covering the standard, large and xlarge labels. Scheduled brownouts beginning October 5 will temporarily fail affected jobs before retirement, and reduced capacity may lengthen queues. GitHub directs workflow maintainers to its listed macOS 15 or macOS 26 arm64 alternatives; the announcement includes the individual UTC interruption windows.

GitHub now makes repository accessibility statements easier to find from the overview page when maintainers place ACCESSIBILITY.md in the root, .github, or docs directory. Public repositories also let contributors add or propose a statement through Community Standards. The change is available across GitHub.com plans; GitHub says Enterprise Server support will arrive in version 3.24.

Old checks and workflow history now expire alongside Actions logs and artifacts. GitHub says the same retention setting also covers statuses from third-party apps, subject to organization and enterprise limits. Public repositories retain a maximum of 90 days, and extending the setting cannot bring back records already deleted.

Oct 1, 17:56 UTC Resolved - This incident has been resolved. Thank you for your patience and understanding as we addressed this issue. A detailed root cause analysis will be shared as soon as it is available.

A new branch without a pull request will no longer make GitHub's code coverage upload step fail CI. The action now skips that upload and explains why. For workflows triggered only by pushes, opening a pull request does not itself resume uploads: coverage returns on the next push unless a pull-request trigger is also configured.