PTIR — Daily Briefing — 2026-09-18
by
Executive Summary
GitHub has set two dates that Actions users should put on the calendar. The ubuntu-latest runner label will move from Ubuntu 24.04 to 26.04 between October 19 and November 19. Separately, on November 2 GitHub will enforce a new default that disables pull_request_target in affected public repositories. Both changes can be tested safely before enforcement.
Action Queue
Test every ubuntu-latest workflow on Ubuntu 26.04
Ubuntu 26.04 GitHub-hosted runners are now generally available on x64 and Arm64. GitHub will gradually redirect ubuntu-latest from 24.04 to 26.04 between October 19 and November 19, 2026. Updated or removed preinstalled tools can expose hidden version dependencies.
Recommended action: Search active repositories for runs-on: ubuntu-latest. Add a temporary matrix job or branch that runs the same workflow on ubuntu-26.04, record failures, and pin required tool versions explicitly. If migration cannot be completed in time, temporarily change the production workflow to ubuntu-24.04 and document why.
- Urgency: This week
- Importance: ★★★★★
- Verified active: September 18, 2026
- Deadline: Migration begins October 19 and completes by November 19, 2026
- Cost: Included with normal GitHub Actions usage; no separate runner-image price
- Requirements: A GitHub repository using GitHub-hosted Ubuntu runners
- Official notice: Ubuntu 26 generally available and latest migration
Audit public repositories for pull_request_target
GitHub Actions workflow execution protections are now generally available. They can restrict workflow execution by actor, event, and workflow file, with an evaluate mode that shows what a rule would block before enforcement. GitHub is also rolling out a default rule that disables pull_request_target in public repositories without an applicable event policy because unsafe use can expose repository secrets to code from forks.
Recommended action: Search public repositories for pull_request_target. Review GitHub’s evaluation results, then keep the default block unless a workflow has a documented need and does not execute untrusted fork code. If the trigger is necessary, scope any exception to the exact workflow file and keep secrets and write permissions unavailable to untrusted code.
- Urgency: This week
- Importance: ★★★★★
- Verified active: September 18, 2026
- Deadline: GitHub begins enforcing the affected default rules on November 2, 2026
- Cost: No separate charge stated; availability follows GitHub Actions policy support for the account or repository
- Requirements: A GitHub public repository using Actions; administrative access is required to inspect or change execution policies
- Official notice: Workflow execution protections in GitHub Actions generally available
GitHub Discoveries
The two changes are best handled together: first inventory workflow triggers and runner labels, then test in branches or evaluate mode. This produces a short, evidence-based migration list instead of waiting for an automatic platform change to break a build.
Linux & Self-Hosting
The runner migration is also a useful dependency audit. Workflows that silently rely on a preinstalled package or language version are less reproducible than workflows that install or pin what they need. Treat any Ubuntu 26.04 failure as a signal to make the build definition more explicit.
PKb Candidates
- Actions migration inventory: Repository, workflow path, current runner label, Ubuntu 26.04 result, failing dependency, owner, and remediation deadline.
- Untrusted pull-request boundary: Trigger, token permissions, available secrets, checked-out ref, executable fork content, approval gate, and documented exception.