GitHub publishes its 2026 security roadmap for Actions

2026-03-26 · Publisher : GitHub · Domain : Cloud & DevOps

On 26 March 2026, GitHub details its security roadmap for Actions: workflow dependency locking, execution policies, scoped secrets, a telemetry stream and a native egress firewall.

### Background On 26 March 2026, GitHub publishes a post setting out the 2026 security roadmap for GitHub Actions. It starts from an observation: attacks now target CI/CD automation itself, as tj-actions/changed-files, Nx and trivy-action showed. The roadmap is organized in three layers: the ecosystem, the attack surface and the infrastructure. ### Key facts - Dependency locking: a "dependencies" section in a workflow's YAML pins all direct and transitive dependencies by commit SHA, like go.mod and go.sum. - Execution policies built on rulesets: who can trigger a workflow and which events are allowed, with an evaluate mode before enforcement. - Scoped secrets (repository, branch, environment, workflow) and an end to implicit secret inheritance by reusable workflows; write access no longer grants secret management. - Actions Data Stream: near real-time execution telemetry sent to Amazon S3 or Azure Event Hub, and a native egress firewall for GitHub-hosted runners. - Announced milestones: public preview within 3 to 6 months for most capabilities, general availability within 6 to 9 months. ### Why it matters The roadmap turns the lessons of the 2025 and 2026 attacks into product: stop resolving dependencies at run time, restrict triggers, bind secrets to trusted contexts and make CI observable like a production system. For platform teams and consulting firms, it provides a staged hardening plan, to follow now with practices already possible (SHA pinning, minimal permissions). ### Takeaway GitHub turns CI/CD incidents into features: locking, policy, scoped secrets and an egress firewall.

Tags : Sécurité, CI/CD, DevOps, Observabilité