Content by Allison (1076)

Allison explains how GitHub’s code security and secret risk assessments now distinguish findings in protected and unprotected repositories. The update helps organization admins and security managers identify gaps in security coverage, with availability in GitHub Enterprise Cloud and GitHub Team and planned secret assessment support in Enterprise Server 3.24.

Allison outlines GitHub Actions’ upcoming default block on pull_request_target events in public repositories, with enforcement moved to December 2, 2026. Two November brownouts will help maintainers identify affected workflows. The update explains how to review blocked runs and explicitly permit workflows while accounting for risks to repository secrets.

Allison details three additional IP ranges for GitHub webhook deliveries, now included in the Meta API. Teams using static network allowlists need to add the prefixes to avoid rejecting deliveries. Allowlists kept current through the Meta API require no changes, and the additions apply across all github.com plans.

Allison announces the general availability of GitHub Copilot Fusion, which selects and orchestrates models for coding tasks. Developers choose between three effort levels, while administrators control eligible models and defaults. The announcement also covers supported clients, per-model billing, and a temporary discount for paid Copilot plans.

Allison introduces updates to the GitHub Copilot app, including Projects for coordinating work across repositories and connected tools, and computer use in public preview on macOS and Windows. The app can return pull requests for review, work with design context, and control desktop apps with user approval.

Allison outlines a new GitHub Enterprise licensing model that includes GitHub Copilot access for licensed users, with AI usage charged against an enterprise budget. The announcement explains which features remain available without budget, the $10 monthly standalone option, and initial availability for enterprises working with GitHub or Microsoft account teams.

Allison introduces the GitHub security extension, now in public preview for the GitHub Copilot app. Developers can browse code scanning alerts, ask Copilot to explain or fix them locally, and review changes before opening pull requests. The announcement also covers permissions, AI credit usage, and supported GitHub environments.

Allison introduces GitHub intelligence, a context layer combining persistent Copilot memories, opt-in dreaming, and cross-repository code search. Copilot Memory is generally available on paid plans, while dreaming enters public preview with controls for personal and repository context, pull-request review of instruction changes, and AI-credit costs.

Allison introduces shared Copilot Automations, which let teams maintain repository-owned AI workflows for bug reproduction, pull request screenshots, and incident investigation. The rollout adds shared visibility, editing permissions, repository-owner billing, and workflows that keep running when their creator leaves, with an administrator policy required for organization-owned repositories.

Allison outlines GitHub Copilot updates in VS Code, including cloud session continuity, persistent local and remote agents, and mobile controls. The releases also cover parallel model comparisons, experimental desktop interaction, custom clients through Agent Host Protocol, and preview marketplaces and connectors with enterprise policy controls.

Allison announces general availability of repository plugin defaults and enterprise-managed plugin controls for GitHub Copilot. Maintainers can configure default plugins, while enterprise administrators can require or block plugins and restrict marketplaces. The controls work across VS Code, Copilot CLI, and the GitHub Copilot app, with managed settings overriding personal choices.

Allison introduces image generation and editing in GitHub Copilot, powered by GPT Image 2.5 Flare. The public preview lets developers request images conversationally, preview them inline, and save them to their workspace. Image tokens are billed separately from chat, while administrators can disable the feature through model policies.

Allison announces an opt-in experimental preview of GitHub Copilot Fusion routing between supported local and cloud models. The update covers managed Windows setup and manually configured CLI models across Windows, macOS, and Linux, with important limits: routing still requires the cloud, and local models may offer different safety protections.

Allison announces general availability of GitHub Agentic Workflows, which compiles natural-language Markdown into GitHub Actions workflows powered by coding agents. The release adds runner support, model routing, and stronger isolation, with read-only defaults and validated outputs. The default GitHub Copilot CLI engine requires a Copilot license.

Allison introduces Dependabot reachability analysis, now in public preview for JavaScript and TypeScript on GitHub Enterprise Cloud. Using CodeQL and managed GitHub Actions workflows, it identifies call paths to vulnerable dependency functions and adds verdicts to alerts, helping teams prioritize remediation without automatically dismissing vulnerabilities.

Allison announces public preview support for server-to-server authentication in GitHub Copilot. GitHub Apps can use short-lived installation tokens to make SDK requests on behalf of an organization without user credentials. Usage is billed to the organization, with its model policies, budgets, spending controls, and app access controls applied.

Allison announces general availability of assisted permissions in GitHub Copilot CLI, GitHub Copilot app, and Visual Studio Code. A language model evaluates command, file-path, and URL requests, automatically allowing those classified as clearly safe. Enterprise administrators can control available permission modes and set defaults for new sessions.

Allison announces GPT-6.1 Terra’s general availability in GitHub Copilot for everyday agentic coding and terminal tasks. The model uses provider list pricing under usage-based billing, with gradual rollout across supported clients. Business and Enterprise administrators can control access through model policies and default enablement settings.

Allison announces an update to the GitHub Copilot usage metrics API that adds a new totals_by_client breakdown, letting enterprises and organizations see request, session, and token usage coming from tools outside the IDE (like OpenCode, Copilot CLI, VS Code, and JetBrains).

Allison announces an updated GitHub app for Microsoft Teams that combines GitHub notifications with GitHub Copilot-powered actions, letting teams respond to issue and pull request updates by mentioning @GitHub to investigate, fix bugs, run tests, and open pull requests from within Teams.

Allison explains a GitHub Enterprise Managed Users (EMU) incident where SCIM deprovisioning incorrectly deleted accounts instead of suspending and obfuscating them, how to confirm impact via audit logs, and what GitHub changed to restore records and prevent recurrence.

Allison announces new GitHub public monitoring capabilities for handling leaked secrets at enterprise scale, including alert triage workflows, continuous token validity checks, and integrations via a REST API and enterprise webhooks for incident response pipelines.

Allison announces general availability of enterprise-level installations for GitHub Apps, expanding API and permission coverage so enterprises can migrate more automation away from classic PATs and manage governance, security, and admin settings through GitHub Apps.

Allison summarizes the September 2026 update for GitHub Copilot in Visual Studio 2026, including PR exploration via the Git agent, preview BYOM support (with a breaking change to the new Agent harness), and a new flow to fix NuGet Audit vulnerabilities directly from the Error List.

Allison announces an update to the Copilot usage metrics API that reports configured names for custom skills, custom agents, MCP servers, slash commands, and plugins (instead of grouping them as “other/custom”), making it easier for admins to track adoption and usage trends across an organization.

Allison announces general availability of a global default policy for GitHub Copilot features on Copilot Business and Copilot Enterprise, explaining how unconfigured settings will be enforced during the rollout and where admins can review and override defaults.

Allison announces new GitHub Actions blob storage hosts that are now included in the GitHub meta API, with guidance for organizations that use network allowlists to avoid interruptions to job summaries and logs.

Allison announces a public preview feature for GitHub Enterprise Cloud with data residency that expands secret scanning to public commits on github.com, while keeping alert delivery and data handling within the customer’s residency region via verified domain matching.

Allison announces two GitHub pull request review improvements: a saved whitespace visibility preference that persists across pull requests, and a split-view change where new and deleted files use the full width to reduce wrapping and improve readability.

Allison announces a new “Industry comparison” view in the GitHub Copilot impact dashboard, letting opted-in enterprises benchmark agentic adoption and leverage against aggregated peer data, with controls for policy-based participation, daily refresh, and data residency boundaries.

Allison announces a public preview in GitHub CLI v2.103.0 that lets you opt in to expiring, auto-refreshing OAuth credentials, reducing the risk of long-lived leaked tokens. The post explains how to enable the feature, how it behaves with Git over HTTPS, and what to watch for in scripts that cache tokens.

Allison announces a GitHub repository governance update that lets you convert all classic branch protection rules into repository rulesets in one action, making it easier to standardize and manage branch policies at scale across branches and organizations.

Allison summarizes recent improvements and bug fixes in GitHub secret scanning, including an upcoming audit log field change that may affect integrations, plus updates to token revocation support, webhook payloads, and several API and push-protection edge cases.

Allison announces an update to the Dependabot alerts REST API that adds a new version_requirement field, making it easier to retrieve the dependency version (or constraint) recorded for an alert without parsing lockfiles or issuing separate GraphQL queries.

Allison announces GitHub package firewall in public preview for GitHub Enterprise Cloud, a supply-chain security feature that inspects package metadata and downloads to block malicious dependencies before they reach CI/CD hosts or developer workstations.

Allison announces expanded Dependabot support for newer package manager versions (npm 12, pnpm 11/12, and Bun 1.4), so teams can upgrade and continue receiving automated dependency update PRs across GitHub.com and GitHub Enterprise Server.

Allison announces generally available REST API endpoints for retrieving and updating GitHub Copilot model policies across enterprises, organizations, teams, and enterprise apps, making it easier to centrally control which Copilot models are available at each scope.

Allison announces that several AI models have been deprecated across GitHub Copilot experiences as of October 19, 2026, and lists the supported replacement models. The post also calls out what Copilot Enterprise admins may need to change in model policies so alternatives show up in Copilot Chat.

Allison explains a GitHub availability protection that can temporarily require authentication for some public-repo clones and fetches over HTTPS during unusual traffic, and outlines practical ways to make CI and automation more reliable using GitHub Actions tokens or GitHub App/PAT-based auth.

Allison explains how changes in macOS 27 and Xcode 27 break CodeQL’s traced extraction, which impacts CodeQL scanning for multiple compiled languages and blocks Swift 6.4 analysis. The post outlines what’s affected and the practical workflow changes needed to keep GitHub Actions scans running.