pnpm is now fully supported by dependency graph, Dependabot alerts, and Dependabot security updates! If you manage your Node.js dependencies with the pnpm package manager, you can now receive and fix alerts about security vulnerabilities in those dependencies. To use this, enable Dependabot Security Updates from the repository settings page on the code security and analysis tab.
We will be moving the private beta of required workflows on GitHub Actions to Repository Rules to give organization administrators a powerful way to protect their repositories with added feature benefits including unified configuration, dry running workflow rules, branch targeting, and a consistent UI experience.
Starting September 20th, 2023, users can configure their workflows using rulesets in order to run and pass in selected repositories before merging their code. On October 18th, users will no longer be able to access Actions Required Workflows and must use rulesets in its place.
Existing Actions Required Workflows private beta users will continue to have access until October 18th, 2023, allowing them time to adapt to the forthcoming changes. During this transitional period, users will maintain their existing workflows without disruption. This ensures that organizations can smoothly navigate the migration process, avoiding any abrupt disruptions to their current code merging practices. Here’s a quick overview of the events leading up to the move.
Leading up to October 18th:
- GitHub will attempt to automatically migrate any existing Required Workflows to Rulesets for customers.
- Any workflow files that did not successfully migrate will need to be manually migrated by code owners.
After October 18th:
- The ability to require a workflow to pass before merging code will only be available on GitHub Enterprise plans via Repository Rules
- Organization Rulesets will enable administrators to define, configure, and manage all workflows required to pass before merging code in repositories.
- The feature formally known as Actions Required Workflows will no longer be accessible and users will be directed to Rulesets.
- GHES 3.8 and 3.9 will not be impacted until their next upgrade
- GHES 3.10 and 3.11 will not be impacted if Actions Required Workflows are already in use
- GHES 3.12 Requiring a workflow to run and pass before merging will be only be available vis Repository Rulesets
To learn more about how Repository Rules can help control how people can interact with branches, visit our documentation.