Skip to content

GitHub Actions : Ubuntu 16.04 LTS virtual environment will be removed on September 20, 2021

As part of our ongoing efforts to keep the hosted actions runners updated and secure, the Ubuntu 16.04 LTS virtual environment will be removed from GitHub Actions on September 20, 2021. For workflows using ubuntu-16.04, you will need to update your workflow files to run on ubuntu-latest which will run on the Ubuntu 20.04 LTS environment instead.

To help make sure all affected customers are aware of this change, we will temporarily suspend workflows on Ubuntu 16.04 LTS environment for two short 'brownout' periods ahead of the final removal. Builds that are scheduled to run during the brownout periods will fail. Therefore it is recommended that you should plan to move to a supported version of Ubuntu before September 6, 2021. The brownouts are scheduled for the following dates and times:

  • September 6, 2021 5:00pm UTC – 10:00pm UTC
  • September 14, 2021 5:00pm UTC – 10:00pm UTC

You can learn more about our software and image guidelines for GitHub-hosted runners in the virtual environment repository. Please contact support if you experience any issues due to this change.

Flag unsigned commits with vigilant mode

To improve security and confidence in the authenticity of your contributions, you can flag commits and tags on GitHub.com that are attributed to you but not signed by you. With vigilant mode enabled (now available in beta), unsigned commits attributed to you are flagged with an Unverified badge. This can alert you and others to potential issues with authenticity.

The author and committer of a Git commit can easily be spoofed. For example, someone can push a commit that claims to be from you, but isn’t. Like showing a passport, committers can increase trust in their commits by signing them with a GPG or S/MIME key. And now, when you enable vigilant mode, commits will be flagged if they’re attributed to you but not signed by you. This raises attention if someone tries to spoof your identity as a committer or author. With vigilant mode enabled, all of your commits and tags are marked with one of three verification statuses: Verified, Partially verified, or Unverified.

Commits and tags are marked with one of three verification statuses

Try it yourself! First, check out how to automatically sign your commits. Then, enable vigilant mode in your account settings:

Vigilant mode in GitHub.com personal account settings

Be sure to enable vigilant mode after you start signing your commits and tags. Once you enable it, any unsigned commits or tags that you push to GitHub.com will be marked "Unverified," including past commits.

Learn more about vigilant mode.

See more
View all changes