Back to changelog CodeQL is the static analysis engine behind GitHub code scanning , which finds and remediates security issues in your code. We’ve recently released CodeQL 2.24.3 , which adds…
…Copilot Business and Copilot Enterprise users are not affected by this update. Here’s a quick overview of the changes and how they affect your GitHub experience. What’s new in the…
…security controls to Free, Team, and Enterprise customers. You can define exactly which actions and reusable workflows run in your repositories to enforce least privilege principles, protect against potentially compromised actions, and…
…Build custom images from custom images actions Jun.18 Release Safer pull_request_target defaults for GitHub Actions checkout actions supply chain security Jun.18 Release Control who and what triggers GitHub…
…Please use the feedback discussion to report problems, ask questions, and review known issues. May.13 Release GitHub Enterprise Server 3.21 release candidate is available collaboration tools May.08 Improvement Disable…
…and code scanning. These settings are not required, but strongly recommended to improve the supply chain security of your repo. Enabling immutable releases, for example, means even if someone gets control of…
…Improved UI, rubber duck, prompt scheduling, and voice input client apps copilot Jun.02 Release Cloud and local sandboxes for GitHub Copilot now in public preview application security copilot platform governance Jun…
…Choose where Copilot runs—on your local machine or in the cloud—and begin unlocking agent-driven workflows while prioritizing security and enterprise policy enforcement, and without local resource constraints. With local…
…This post explains how we built Agentic Workflows with security in mind from day one, starting with the threat model and the security architecture that it needs. Threat model There are two…
…What’s coming to our GitHub Actions 2026 security roadmap A look at GitHub Actions’ 2026 roadmap, outlining how secure defaults, policy controls, and CI/CD observability harden the software supply chain…