actions

As part of our ongoing efforts to keep the hosted actions runners updated and secure, the Ubuntu 16.04 LTS virtual environment will be removed from GitHub Actions on September 20, 2021. For workflows using ubuntu-16.04, you will need to update your workflow files to run on ubuntu-latest which will run on the Ubuntu 20.04 LTS environment instead.

To help make sure all affected customers are aware of this change, we will temporarily suspend workflows on Ubuntu 16.04 LTS environment for two short 'brownout' periods ahead of the final removal. Builds that are scheduled to run during the brownout periods will fail. Therefore it is recommended that you should plan to move to a supported version of Ubuntu before September 6, 2021. The brownouts are scheduled for the following dates and times:

• September 6, 2021 5:00pm UTC – 10:00pm UTC
• September 14, 2021 5:00pm UTC – 10:00pm UTC

You can learn more about our software and image guidelines for GitHub-hosted runners in the virtual environment repository. Please contact support if you experience any issues due to this change.

GitHub Actions now supports a concurrency key at both the workflow and job level that will ensure that only a single run or job is in progress.

There are a number of scenarios where you only want a single instance of a particular workflow or job running at any given time. For example: if you have a deployment to your production environment ensuring that only a single deployment is happening at any given time and that you are always deploying the latest code can be important. The concurrency key can be any string or an expression using the github context. When a job or run starts it first checks to see if anything is currently holding on to the concurrency group specified. If not, it will start. If there is a lock on the group, the job or run will be marked as pending and will only start after the blocking job or run completes.

Learn more about concurrency groups in GitHub Actions

For questions, visit the GitHub Actions community

To see what's next for Actions, visit our public roadmap

You can now use setup-java v2 to download and cache binaries from different distributions, including Adopt OpenJDK and Zulu OpenJDK.

With setup-java v2, you can:

• Add Java distributions of your choice
• Get native support for Adopt OpenJDK
• Reduce your Java setup time significantly as the action can utilize pre-cached Adopt OpenJDK distributions from GitHub-hosted runner images

As part of the v2 release, setup-java now requires a mandatory distribution argument and no longer supports legacy Java version syntax 1.x. You can use our migration guide to learn more about upgrading to v2.

steps:
- uses: actions/checkout@v2
- uses: actions/setup-java@v2
  with:
    distribution: 'adopt'
    java-version: '11'
- run: java -cp java HelloWorldApp

For questions, visit the setup-java repo and GitHub Actions community

The Audit Log now includes events associated with GitHub Actions workflow runs. This data provides enterprise customers with a greatly expanded data set for security and compliance audits.

New events will be incorporated into the audit log when:

• A workflow run is created, completed, deleted, or re-run
• A workflow job is prepared. Importantly, this job will include the list of secrets that were provided to the runner
• A self-hosted runner’s version is updated

These new events are only available to customers on the Enterprise plan. All events are available in the REST API, and all events except for workflow run created, workflow run completed, and workflow job prepared are available in the UI and exports.

Learn more about Audit Log events

For questions please visit the GitHub Actions community forum

To see what’s next for GitHub Actions, visit our public roadmap.

The API for environments, and environment protection rules is now available. The API enables you to automate scenarios like creating an environment or approving a deployment.

Learn more about the Environments API
Learn more about the GitHub Actions API

For questions visit the GitHub Actions community

You can now limit which branches can deploy to an environment using Environment protection rules.

When a job tries to deploy to an environment with Deployment branches configured Actions will check the value of github.ref against the configuration and if it does not match the job will fail and the run will stop.

The Deployment branches rule can be configured to allow:

1. All branches – Any branch in the repository can deploy

2. Protected branches – Only branches with protection rules

3. Selected branches – Branches matching a set of name patterns

   

Learn more about Environment protection rules

For questions, visit the GitHub Actions community

To see what's next for Actions, visit our public roadmap

GitHub Actions now supports skipping push and pull_request workflows by looking for some common keywords in your commit message.

If any commit message in your push or the HEAD commit of your PR contains the strings [skip ci], [ci skip], [no ci], [skip actions], or [actions skip] workflows triggered on the push or pull_request events will be skipped.

For questions, visit the GitHub Actions community

To see what's next for Actions, visit our public roadmap

Beginning March 1, 2021, we will remove .NET Core 3.0 from macOS 10.15, Ubuntu 16.04, and Ubuntu 18.04 virtual environments for GitHub-hosted runners. We follow a general guideline of removing software tools from our hosted images six months after they are deprecated, and .NET Core 3.0 reached its end of life on March 3, 2020.

You can continue to use .NET Core 3.0 with our setup-dotnet action. The setup-dotnet action is always the recommended way of using .NET with GitHub Actions because it ensures consistent behavior across different runners or versions of .NET and protects your workflow from possible future deprecation of additional .NET versions:

steps:
- uses: actions/checkout@main
- uses: actions/setup-dotnet@v1
  with:
    dotnet-version: '3.0.x'
- run: dotnet build <my project>

For the latest updates, be sure to subscribe to the announcement in the actions/virtual-environments repository.

On February 15th, GitHub Actions will remove support for referencing actions using the shortened version of a git commit SHA. This may cause some workflows in your repository to break. To fix these workflows, you will need to update the action reference to use the full commit SHA.

For example, if your workflow references actions/checkout@5a4ac90, you should change it to actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f. You can find the full commit SHA in the referenced action's repository.

This change is being made to align product functionality with our published security guidance

Today we are releasing an open beta for the new continuous delivery capabilities in GitHub Actions. In this open beta there is no need to sign up, all existing GitHub organizations and accounts can use the new capabilities in their public repositories and GitHub Enterprise Cloud organizations can use them in all repositories.

The addition of environment protection rules and environment secrets enable separation of concerns between deployment and development to meet compliance and security requirements. The required reviewers environment protection rule will automatically pause a job trying to deploy to the protected environment and notifies the reviewers. Once approved, the job runs and is given secured access to the environment’s secrets. Also, the environments page includes a deployment log and information on the latest code change deployed to each environment.

Learn more about environments

For questions, visit the GitHub Actions community

To see what's next for Actions, visit our public roadmap