01
Infrastructure
GitHub Actions Runner Controller 0.15.0 Cuts API Traffic for Large Runner Fleets
Operators running big self-hosted runner pools get tunable rate limits, concurrency and shutdown timing, plus lighter load on the Kubernetes API.
Operators running big self-hosted runner pools get tunable rate limits, concurrency and shutdown timing, plus lighter load on the Kubernetes API.
The hosting service will close after attackers reached its systems with leaked credentials and exposed data tied to 321,810 accounts.
The company has re-enabled release immutability after blocking the altered packages and tells affected users to clean systems and rotate secrets.
Developers can carry one Copilot task into the editor without starting over, keeping the same context as they review and change code.
GitHub is testing a physical shortcut layer for Copilot so developers can trigger common actions without leaving their workflow.
Maintainers can now get star trends in one request, while detailed user lists are limited to repo admins and collaborators.
GitHub made progress on moving production traffic and tightening failure handling, but recent incidents and a missed migration target show the work is not done.
The faster system lets generic secret detection run in push protection, so likely secrets can be caught before code is accepted.
The rewrite makes Copilot faster to embed in host apps and keeps an out-of-process option for setups that still need it.
The self-hosted runner tool is now generally available at no extra cost, but teams upgrading from the preview must take runners offline first.
The malware operation has resumed at scale, making it harder for GitHub takedowns to remove every copy at once.
GitHub is trying to catch more exposed credentials earlier as AI agents and push volume keep rising.
The benchmark is meant to make offline comparisons between code reviewers more useful for production decisions.
The findings show that secret leaks can stay exposed for years even where GitHub’s Push Protection reduces some new exposure.
The service gives agent builders a managed runtime and controlled tool access instead of making them assemble that layer themselves.
Open source taskflows built on GitHub’s AI agent have already exposed dozens of Android flaws in real apps.
New Git release tightens merge safety and boosts performance on large repos while shrinking storage footprints.
The campaign extends from tenant-wide resource wipes to direct hits on AI datasets and vector stores.
Teams that invoked the affected actions may need to check whether workflow-accessible credentials were exposed.
Kelley defends prioritizing human mentorship over AI code and says moving to Codeberg restored reliable CI for Zig.
Users and the agent can update a shared workspace as work progresses, then keep it for a project or personal reuse.
The campaign bypasses npm v12’s install-time checks and has already landed in projects via millions of downloads.