Actions retention now covers checks, runs, and statuses

GitHub has expanded its advisory GraphQL interface with CVE identifiers, affected source-code links, GitHub review dates, NVD publication dates and links to associated repository advisories. New severity and withdrawal filters let integrations narrow results before downloading them. GitHub says the additions reduce the need to switch to REST for advisory data; they are read-only changes that preserve existing queries.

GitHub will remove its macOS 14 Actions runner images on November 2, 2026, covering the standard, large and xlarge labels. Scheduled brownouts beginning October 5 will temporarily fail affected jobs before retirement, and reduced capacity may lengthen queues. GitHub directs workflow maintainers to its listed macOS 15 or macOS 26 arm64 alternatives; the announcement includes the individual UTC interruption windows.

GitHub now makes repository accessibility statements easier to find from the overview page when maintainers place ACCESSIBILITY.md in the root, .github, or docs directory. Public repositories also let contributors add or propose a statement through Community Standards. The change is available across GitHub.com plans; GitHub says Enterprise Server support will arrive in version 3.24.

Oct 1, 17:56 UTC Resolved - This incident has been resolved. Thank you for your patience and understanding as we addressed this issue. A detailed root cause analysis will be shared as soon as it is available.

Turning on code scanning no longer starts months of weekly scans for an otherwise dormant repository. GitHub still runs the initial validation, but scheduled scanning begins only after a push or pull request triggers analysis. The change applies to Enterprise Cloud, requires no configuration changes and is planned for Enterprise Server 3.24.

A new branch without a pull request will no longer make GitHub's code coverage upload step fail CI. The action now skips that upload and explains why. For workflows triggered only by pushes, opening a pull request does not itself resume uploads: coverage returns on the next push unless a pull-request trigger is also configured.