From November 12 onward, we will no longer include Node16 in the Actions runner and customers will no longer be able to use Node16 Actions or operating systems that do not support Node20.
To prevent disruption to your Actions workflows, if you’re an Actions maintainer, update your actions to run on Node20 instead of Node16. If you’re an Actions user, update your workflows with latest versions of the actions, which run on Node20.
Over the next six months, we will be making the following changes and deprecations to the GitHub Actions service:
Reduction to Webhook rate limit in GitHub Actions
Starting October 1st, 2024 we will be adding a new rate limit of 1,250 requests per 10 seconds per repository for incoming Webhook events for GitHub Actions. After monitoring usage over the past several weeks, we believe that no customers will be impacted by this change, but if you believe you will need to exceed this in the future, please reach out to GitHub support.
Cache v1-v2 deprecation
Starting February 1st, 2025, Actions’ cache storage will move to a new architecture, resulting in the deprecation of v1-v2 of actions/cache. Attempting to use a version of the action after the announced deprecation date will result in a workflow failure. Please note: if you are pinned to a specific version or SHA of the action, your workflows will also fail after February 1st. We strongly encourage you to update your workflows to begin using v3 or v4 of actions/cache as soon as possible.
This deprecation will not impact any existing versions of GitHub Enterprise Server that are currently in use. Cached entries within their retention period will remain accessible from the UI or REST API regardless of the version used to upload. This announcement will also be added to the actions/cache repository.
Arm64 Linux and Windows GitHub-hosted runners for Actions are now generally available. This new addition to our suite of hosted runners provides power, performance & sustainability improvements for all your Actions jobs. Arm64 runners are available to customers on our Team and Enterprise Cloud plans.
“We switched to the GitHub arm64 runners from a custom, self-managed setup on AWS Graviton instances. Switching to GitHub runners has saved us over 75% on our monthly fees and removed all the management overhead, which is particularly important given we’re a seed stage startup. The ARM runners have significantly improved build times from over 30 minutes on x86 runners to around 4 minutes on ARM. This allows us to iterate on pull requests much faster, and run the build process for ARM and x86 in parallel as part of the same GitHub Actions workflow, simplifying the process of getting code to production for our development team.” -David Mytton, Founder, Arcjet
Head over to the GitHub blog to read more about the benefits of arm64 runners and how to get started.
GitHub Actions will be making the following deprecations and breaking changes in our runners and services over the next 6 months.
Exclude hidden files by default in Upload Artifact GitHub Actions
From September 2nd, 2024, we will no longer include hidden files and folders as part of the default upload of the v3 and v4 upload-artifact actions. This reduces the risk that credentials are accidentally uploaded into artifacts. Customers who need to continue to upload these files can use a new option, ‘include-hidden-files’, to continue to do so.
Ubuntu 20 & Ubuntu 22 arm64 Images
On September 3rd, 2024, we are deprecating the Ubuntu 22/20 base images for our arm64 hosted runners as these are not widely used and customers are better served using the new Arm owned images. At that time all workflows using the Ubuntu 22 or 20 base image on arm64 will begin to fail. To change the image your runner is using, you can delete the runner and recreate a runner with the same name, to prevent failures. We recommend using the partner images provided by Arm:
Ubuntu 24.04 by Arm Limited
Ubuntu 22.04 by Arm Limited
.NET6 deprecation in the runner
In October, 2024, at the same time as we move to Node20 on the Actions runner, we will be deprecating .NET6 in the Actions runner and moving to .NET8. This is because .NET6 will reach end of life in November 2024. Any customers who are still using operating systems which are reliant on unsupported binaries will need to upgrade prior to this change. The removal of support for .NET6 means the following operating systems will no longer be supported from this time:
– Debian 10
– macOS 11.0
– macOS 10.15
macOS12 runner image
We are beginning the deprecation process for the macOS 12 runner image, which allows us to balance our fleet capacity ahead of our upcoming macOS 15 launch. This image will be fully retired by the December 3rd, 2024. We recommend updating workflows to use `macos-14`, `macos-13`, or `macos-latest`.
Unsupported macOS labels
On December 3rd, 2024, we are deprecating some of our older and less used labels which are used for smaller numbers of workflows. The following runner labels will stop working from that time:
Developers can now manually run workflows set with workflow_dispatch directly from the Workflow view (Repository -> Actions -> Workflows) on GitHub Mobile. This addition provides developers with greater flexibility and control over their workflows, enabling them to trigger workflows manually while on the go using GitHub Mobile. Whether they are away from their desks, traveling, or simply need to run a workflow quickly, this feature ensures developers can manage their projects efficiently from anywhere.
Actions Usage Metrics is now generally available for all GitHub Enterprise Cloud customers. Actions Usage Metrics enables you to view data about your Actions workflow runs throughout your organization. You can use this data to identify opportunities to optimize your pipelines and reduce wasted runtime minutes which, when addressed, can lead to faster runs and increased developer productivity. Actions Usage Metrics breaks down the utilization of workflows, jobs, source repositories, and operating systems for GitHub hosted runners and self-hosted runners. All of this data is available in the UI and can be exported and shared as a .csv file if you wish to integrate your usage data with internal or third party tools.
To learn more about Actions Usage Metrics, check out our docs or head to our community discussion to ask questions and provide feedback.
GitHub Actions GPU hosted runners are now generally available for Windows and Linux, providing T4 GPU access to Actions customers.
The GPU hosted runners are fully managed by GitHub, with images managed by trusted partners on the Azure marketplace. They are also compatible with GitHub-hosted runners’ static IPs and private networking capabilities.
Get started
You can begin using GPU hosted runners in your organization or enterprise by:
Setting up new larger runner GPUs through your runner groups
Updating the ‘runs-on’ syntax in your Actions workflow file to call that runner name
GitHub Artifact Attestations is generally available
We’re thrilled to announce the general availability of GitHub Artifact Attestations! Artifact Attestations allow you to guarantee the integrity of artifacts built inside GitHub Actions by creating and verifying signed attestations. With this release, you can now easily verify these artifacts before you deploy them in your Kubernetes cluster. Powered by Sigstore, Artifact Attestations help you secure your software’s supply chain by creating an unforgeable link between artifacts and their build process.
“Over the past nine months, Trail of Bits has worked closely with GitHub to make Homebrew one of the earliest public adopters of Artifact Attestations. Software, and especially open source software, is more complicated and interconnected than ever, and we believe strongly that GitHub’s new Artifact Attestations feature is a huge and necessary step towards addressing the problem of complex, opaque, software supply chains.” – William Woodruff, Engineering Director, Trail of Bits
“Using Artifact Attestations, we finished a project in under a week that we originally scoped out for months to complete.” – Mike Place, Director of Software Engineering at Elastic
Adding provenance to a GitHub Actions workflow is simple! You just need to invoke the new attest-build-provenance Action with the path to your artifact:
Enhance your SDLC’s security with a Kubernetes admission controller
With general availability we are also releasing a new way to build a Kubernetes admission controller that can validate attestations directly within your Kubernetes clusters. This means that only properly attested artifacts can be deployed, adding an extra layer of security and compliance to your software development lifecycle (SDLC). By integrating Artifact Attestations into your GitHub Actions workflows, you enhance the security of your development and deployment processes, protecting against supply chain attacks and unauthorized modifications.
Setting up an admission controller for GitHub Artifact Attestations involves deploying the Sigstore Policy Controller, adding a TrustRoot and ClusterImagePolicy to your cluster, and enforcing those policies on a per-namespace basis. Quickly deploy your own admission controller using our Helm charts.
To start using the new features, check out our documentation and watch the video below for a step-by-step guide on integrating artifact attestations into your workflows. This feature supports both public and private repositories, making it easier than ever to secure your projects.
Integrate GitHub Artifact Attestations into your workflows today, and add meaningful security to your SDLC. Please join the discussion in the GitHub Community and share your feedback with us.
Developers can now run their Actions workflows using Ubuntu 24.04 on the GitHub-Hosted arm64 runners that are currently in public beta.
To get started using Ubuntu 24.04, create an arm64 runner in your organization/enterprise, and select the “Ubuntu 24.04 by Arm Limited” partner image. Then update the runs-on syntax in your GitHub Actions workflow file to match that runner name. To learn more about how to set-up arm64 hosted runners, you can check out the documentation.
This new image is provided by Arm and is not maintained by GitHub. If you spot any issues with your workflows when using Ubuntu 24.04, or if you have feedback on the software installed on the image, you can provide feedback in the partner-runner-images repository.
We are excited to announce that organizations within an enterprise can now create network configurations independently of their enterprise for Azure private networking. Azure private networking is a powerful feature that allows you to run your GitHub Actions workflows on GitHub-hosted runners connected to your Azure virtual network, without compromising on security or performance. Previously, only enterprises and organizations associated with team plans could create network configurations. This caused a bottleneck for administrators who have been delegated the responsibility for managing network configurations.
Moving forward, enterprise administrators can enable this feature by navigating to the “Hosted compute networking” section of their enterprise policies and selecting “Enabled”. Once this setting has been saved, all organizations associated with the enterprise will be able to create their own network configurations.
To start using Azure private networking for GitHub Actions, follow this guide to walk you through configuring Azure resources and creating an Actions network configuration. For additional information, check out our docs here. Please note that Azure private networking is available for GitHub Enterprise Cloud & Team plans.
Today, GitHub announced the public beta of ArmⓇ-based Linux and Windows hosted runners for GitHub Actions.
This new addition to our suite of hosted runners provides power, performance & sustainability improvements for all your Actions jobs. Developers can now take advantage of Arm-based hardware hosted by GitHub to build and deploy their release assets anywhere Arm architecture is used. These runners are priced at 37% less than our x64 Linux and Windows runners.
The Arm64 runners are fully managed by GitHub with an image built by Arm containing all the tools needed for developers to get started. To view the list of installed software, give feedback, or to report issues with the image, head to the new partner runner images repository.
Arm runners are available to customers on our Team and Enterprise Cloud plans. We expect to begin offering Arm runners for open source and personal accounts by the end of the year.
Get Started
Customers can begin using these runners today by creating an Arm runner in their organization/enterprise, then updating the runs-on syntax in their Actions workflow file to call that runner name.
More information on how to set up Arm-hosted runners can be found in our public documentation.
To learn more about hosted runner per minute rates, see our rate table.
GitHub Actions has recently made changes to the available macOS runner images and the GitHub meta API. Below is a summary of the changes and possible impact to your use of GitHub-hosted macOS runners:
macOS latest migration
GitHub announced in April 2024 the general availability of macOS 14. As of today, we have completed the migration and all macos-latest workflows now use macOS 14.
macOS 11 deprecation and removal
In January 2024, GitHub announced the deprecation of macOS 11 and the removal of the runner image by June 2024. The macOS 11 runner image will be removed on 6/28/2024. We recommend updating workflows to use macos-14, macos-13, macos-12, or macos-latest. Reminder emails will be sent to those who have used the macOS 11 runner image in the past 30 days. Jobs using macOS 11 will temporarily fail during scheduled time periods to raise awareness of the upcoming removal. The schedule can be found below:
June 17 2024, 8:00 AM – 2:00 PM EST
June 19 2024, 12:00 PM – 6:00 PM EST
June 24 2024, 3:00 AM – 9:00 PM EST
June 26 2024, 8:00 AM – 2:00 PM EST
macOS runner IP ranges
Developers and teams have requested that Actions separate macOS runner IP ranges from the rest of Actions so they can allow list them. As of today, developers can isolate macOS runners from the rest of Actions in the GitHub API by using the actions_macos object. The IP addresses may change periodically due to new hardware being brought online or maintenance being performed. To ensure that developers have the most up-to-date information, the IP addresses are refreshed every Monday at 12:30 PM EST.
You can always get up-to-date information on our tools by reading about the software in the runner images repository. For more information on how to use the GitHub API, please see our docs. If you run into any problems or need help, please contact GitHub Support.
On June 30th 2024, we will change the default from Node16 to Node20.
To opt out of this and continue using Node16 while it is still available in the runner, you can choose to set ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true
We will then continue to monitor Node16 usage and will communicate a timeline for the removal of Node16 at the start of October, based on the volume of continued use. This means that customers who use the environment variable to continue to use Node16 now have until October to complete their migrations.
Brownouts will now be run on the 29th of May between 18:00 and 20:00 UTC, during this time multi label larger runner jobs will fail to start. Customers will then no longer be able to use multiple labels or target non-name labels on larger runners after the 17th of June.
To prepare for this change and avoid any disruption, please ensure the runs-on: references only the runner name in your workflows prior to the dates above.
We are happy to announce the beta release of the Ubuntu 24.04 image for GitHub Actions hosted runners. To start using this in your Actions workflows, update your workflow file to include runs-on: ubuntu-24.04
Some users may notice differences in workflows as the Ubuntu 22.04 image has different tools and tool versions, see the full list of changed software.
If you spot any issues with your workflows when using Ubuntu-24.04, or if you have feedback on the software installed on the image, please let us know by creating an issue in the runner-images repository.
While the runner image is in beta, you may experience longer queue times during peak usage hours.
