Content by Allison (1036)
Allison announces general availability of GitHub’s open source license compliance for GitHub Enterprise Cloud, adding enterprise-wide license policies and PR checks to help teams prevent non-compliant dependencies from being merged.
Allison announces general availability of the Xcode 27 GitHub Actions runner image for building and testing Apple apps, including the new runner labels to target the Xcode 27 toolchain on Apple Silicon hosted runners.
Allison announces updates to GitHub Copilot in Slack and Microsoft Teams, including multi-repo support in a single conversation plus improvements to mentions, repository switching, Slack thread context, and overall reliability.
Allison announces a new GitHub Code Quality billing feature that lets organizations download a CSV report of license usage, including which active committers consumed licenses, which repositories they contributed to in the last 90 days, and whether committers are unique to a repo or org.
Allison announces a November 16, 2026 deprecation of several AI models across GitHub Copilot experiences, and explains what admins and teams need to do to keep Copilot Chat, agent modes, and other Copilot features working with supported alternatives.
Allison announces general availability of GitHub’s AI Scan for pull requests, an AI-powered code scanning capability that complements CodeQL by detecting vulnerabilities in PR changes (including languages and file types CodeQL may not cover) and surfacing advisory findings with explanations and suggested fixes.
Allison announces general availability of agentic autofix for GitHub code scanning alerts, where Copilot explores the codebase, proposes and validates fixes with CodeQL, and opens a draft pull request. The post also covers where it can be used, required policies and permissions, and how billing works with AI Credits and Actions minutes.
Allison announces that GitHub has retired email notifications for repository push events as of October 15, 2026, and explains the spam/abuse rationale. The post also points developers to a replacement approach using a GitHub Actions workflow triggered on push to send emails via their own SMTP server or email provider.
Allison announces updates to HydraFusion in GitHub Copilot, including a refreshed frontier-model pool, improved Cascade and Critique orchestration workflows, and a new HydraFusion Max option for deeper reasoning on demanding tasks across VS Code, the Copilot app, and Copilot CLI.
Allison announces a public preview for GitHub Actions workflow dependency lockfiles, aimed at making workflow runs reproducible and reducing supply-chain risk from moved tags/branches or compromised actions. The post explains how to generate and maintain `.github/workflows/actions.lock`, and how admins can enforce lockfile usage with a new policy.
Allison announces a set of GitHub Apps updates focused on least-privilege access and easier administration, including new fine-grained permissions for repository creation and installation management, improved controls for adding approved apps to repos, and changes to token and credential handling for GitHub Apps.
Allison announces general availability of the Gemini 4 Argon model in GitHub Copilot, including where developers can select it, which Copilot plans get access, and how admins can control availability via model policy and default model enablement settings.
Allison announces new GitHub audit log events that let organizations and enterprises track manual dismissals and reopenings of GitHub Code Quality findings, including who performed the action, when it happened, and which repository, rule, and findings were affected.
Allison announces updates to GitHub secret scanning: new detectors for Salesforce, Anthropic, and Cloudsmith, plus expanded push protection defaults that block commits containing Anthropic API keys when secret scanning is enabled.
Allison announces updates to GitHub Copilot enterprise managed settings enforcement, including a startup policy freshness requirement and minimum client version enforcement for the sandbox managed setting key.
Allison announces updates that make it easier to detect when Dependabot alerts have been withdrawn, including a new webhook action and a clearer REST API response for removed alerts.
Allison announces an update to GitHub billing that makes the “Budgets and alerts” page easier to use by listing all budgets in one place with search and filtering, helping personal, organization, and enterprise admins find and manage budgets faster.
Allison announces new Security Overview metrics for GitHub code scanning AI Scan on pull requests, helping org and enterprise admins track findings generated and resolved, remediation rate, repo-level trends, and how often developers apply autofix suggestions.
Allison announces new GitHub Copilot enterprise managed telemetry controls that let admins attribute Copilot activity to a specific user while keeping prompts, responses, and tool content disabled by default, with fine-grained OpenTelemetry capture settings across Copilot CLI, the Copilot app, and VS Code Agent Host sessions.
Allison announces a limited public preview feature that durably records the authenticated GitHub user who pushed each commit, and exposes that pusher identity in the UI and API. It also adds a ruleset condition to block pushes where committer metadata doesn’t match the pusher’s verified emails.
Allison announces a new Dependabot option that lets organizations configure private registries with Anonymous authentication, useful for internal mirrors that allow unauthenticated reads while still working within GitHub.com’s egress allowlist and registry access controls.
Allison announces updates to GitHub Copilot for JetBrains, including enterprise-managed default agent models, a new “Fix” action from diagnostics that opens inline chat, and controls for MCP server startup. The release also improves chat navigation and account UX, boosts reliability, and drops support for JetBrains IDE 2025.1.
Allison summarizes the October 5 weekly GitHub Copilot releases, covering a new Claude Haiku 5.5 model option, generally available local sandboxing controls for agent sessions, Copilot app account separation for licensing vs repos, Copilot CLI local model discovery via Ollama, and new VS Code agent-session management features.
Allison announces CodeQL 2.27.2, detailing new and improved analysis across C/C++, Go, Rust, and JavaScript/TypeScript, plus notable query updates for C# and GitHub Actions. The post also calls out a macOS 27/Xcode 27 limitation for traced analysis and a breaking change in the Go control-flow graph library.
Allison announces new admin controls for GitHub Copilot code review, including organization-level billing options to avoid consuming individual member quotas and policy settings that restrict who can trigger Copilot review requests when external/personal licenses are involved.
Allison announces a GitHub change that lets users with the triage role (and higher) archive and unarchive pull requests, reducing friction for maintainers who delegate routine moderation work.
Allison announces an accessibility improvement to GitHub timelines: screen readers can now navigate issue and pull request timelines as lists, with clearer announcements for structure, position, and newly loaded events across github.com and GitHub Enterprise Server.
Allison announces a GitHub change that lets maintainers include draft pull requests when enforcing pull request limits, closing a loophole where users could open unlimited drafts. The update helps reduce repository clutter, notifications, and unnecessary CI runs caused by low-quality or spammy contributions.
Allison announces that Claude Haiku 5.5 is now generally available in GitHub Copilot, positioned as a lightweight model for fast, high-volume coding tasks like subagents, quick edits, and terminal workflows, with access controlled via Copilot plan entitlements and enterprise model policies.
Allison announces a new fine-tuned GitHub model for context-aware leaked secret detection across secret scanning alerts, push protection, and GitHub Copilot /security-review. The post explains what’s changing, where it’s available (including GHES 3.23), and how AI Credits and budgets apply to the new opt-in checks.
Allison announces general availability of local sandboxing for GitHub Copilot, adding a secure execution boundary for agent-run tools and commands on developer machines across Copilot CLI, the Copilot app, and VS Code Agent Host sessions.
Allison announces an update to GitHub Copilot CLI that lets you discover and select supported local models from a running Ollama instance using the new /model picker, without restarting your session. The post also clarifies how adding local models relates to offline mode, telemetry, and remote providers.
Allison explains why GitHub Copilot usage metrics may undercount agent activity after some IDEs moved agent sessions to the Copilot SDK, and what to do to restore accurate reporting. The post lists the fixed IDE versions, what report gaps to expect, and why missing data can’t be backfilled.
Allison announces general availability of GitHub stacked pull requests, a workflow for breaking large changes into smaller PRs that can be reviewed independently and merged together. The update includes improvements to rebasing, merge queue behavior, approvals preservation, commit signing, webhooks, and GitHub CLI support.
Allison announces an update to GitHub code scanning that adds visibility into AI Scan for pull requests enablement in the Security Overview coverage view, including enabled/not-enabled counts, per-repo effective status, filter queries, and a new CSV export column for tracking adoption across orgs and enterprises.
Allison announces new GitHub Secret Scanning detectors and a new partner integration, expanding the set of credentials GitHub can identify and help remediate when they’re committed to repositories.
Allison announces that GitHub App installation tokens are now issued in a new stateless format by default, and outlines what developers should verify in their integrations to avoid breakages when handling longer tokens and updated validation behavior.
Allison announces that GitHub Copilot code review can now be requested via the REST and GraphQL APIs, and explains the new default “Balanced” review effort level plus where to configure effort settings at the enterprise, organization, repository, and personal levels.
Allison announces changes to npm trusted publishing that reduce supply-chain risk: unvalidated trusted publishing configurations now expire after 48 hours, and GitHub Actions tokens from certain events are rejected for publishing.
Allison announces that npm staged publishing can now create brand-new packages via `npm stage publish`, enabling automated workflows to publish an initial version into a staged queue that must be promoted by a maintainer before it becomes installable.