Read-only Actions cache for untrusted triggers
UpdateVerifiedAdded Sep 22, 2026
GitHub Actions now issues read-only cache tokens to the default branch for workflow events that can be triggered without write permissions to the repository. This applies least privilege to the cache and prevents common privilege-escalation paths through cache poisoning.
Topics: Security, Developer tools
Summaries of vendors' own notes. Product names and logos belong to their owners; logos via logo.dev.
More GitHub Actions releases
Every GitHub Actions release| Date | Release | Type |
|---|---|---|
| Jun 25 | More control over your GitHub-hosted runners Update | Update |
| Jun 25 | Actions steps can now be run in parallel Update | Update |
| Jun 25 | Red Hat Enterprise Linux runner images are now in public preview Preview | Preview |
| Jul 8 | setup-java v5.5.0: signature verification, Kona JDK, and Maven fixes Update | Update |
| Jul 16 | Xcode 27 runner image now in public preview Preview | Preview |
| Jul 28 | GitHub Actions holds potentially malicious workflows for approval Update | Update |
| Jul 30 | Reference same-repository actions with self-repository syntax Update | Update |
| Aug 19 | CodeQL 2.26.3 improves GitHub Actions queries and JavaScript modeling Update | Update |
