GitHub Actions: Restrict self-hosted runner groups to specific workflows

You can now restrict self-hosted runner groups to only be accessible from certain workflows.

In addition to restricting which repositories can access specific enterprise and organization runner groups, administrators can further control access by selecting specific workflow files and versions. Combining this feature with reusable workflow can help you create more secure standard workflows in your organization.

Workflow access dialog

Learn more about restricting access to self-hosted runners

For questions, visit the GitHub Actions community

To see what's next for Actions, visit our public roadmap

Octopus Deploy is now a GitHub secret scanning partner

GitHub secret scanning protects users by searching repositories for known types of secrets. By identifying and flagging these secrets we help protect users from data leaks and fraud associated with exposed data.

We have partnered with Octopus Deploy to scan for access tokens for their cloud-hosted product, Octopus Cloud. Octopus API keys allow users to perform tasks like creating and deploying releases. We'll forward access tokens found in public repositories to Octopus Deploy, who will notify the affected user via email. More information about Octopus Deploy API tokens can be found here.

We continue to welcome new partners for public repo secret scanning. GitHub Advanced Security customers can also scan their private repositories for leaked secrets.

See more

The code scanning alert page shows status and details for the default branch

The code scanning alert page now always shows the alert status and information for the default branch. There is a new ‘Affected branches’ panel in the sidebar to see the status of the alert in other branches. If the alert does not exist in your default branch, the alert page will show the status as ‘In branch’ or ‘In pull request’ for the location where the alert was last seen.

This improvement makes it easier to understand the status of alerts which have been introduced into your code base.

The alert list page is not changed and can be filtered by branch. You can use the code scanning API to retrieve more detailed branch information for alerts.

Read more about alert details.

See more
View all changes