TAG
#github
Stories connected through a shared idea, actor, technology or theme.
GitHub makes agentic autofix for code-scanning alerts generally availableThe feature explores relevant files, iterates on proposed fixes, and validates remediation by rerunning CodeQL before creating a draft pull request. It is available to GitHub Code Security and Advanced Security customers on Enterprise Cloud, with AI Credits and Actions-minute usage.→GitHub Copilot CLI adds agent-scoped hooks and safer autopilot handlingThe release adds agent-scoped declarative hooks, inline image rendering and more robust sandbox settings. It also changes unattended autopilot behavior so a pre-tool hook asking for approval is denied instead of leaving an invisible permission prompt.→GitHub Agentic Workflows defaults read-only runs to no network accessThe release disables network access by default for read-only workflows. It also records richer session provenance, plugin installations and MCP configuration, improving auditability of agent-driven automation.→GitHub Agentic Workflows expands audit ledgers and threat visibilityThe release preserves default ledgers when importing shared workflows and attributes friction costs and experiment data to audit sources. It also narrows action schemas, enforces self-hosted-runner requirements at compile time and hardens private-to-public flow validation.→GitHub Copilot CLI lets custom agents inherit repository instructionsCopilot CLI 1.0.86-1 lets custom agents opt into AGENTS.md, copilot-instructions.md and CLAUDE.md through the `include-custom-instructions: true` frontmatter setting. The release also preserves marketplace plugins and skills when active sessions resume after reload and improves sandbox and background-shell status reporting.→GitHub Copilot Auto adds explicit cost-and-quality tiersThe tiers change how Copilot weighs cost, quality and response time while retaining per-prompt model selection. The feature is rolling out in Visual Studio Code, Copilot CLI and the Copilot app.→GitHub Agentic Workflows routes release-note writes through a safe outputThe release makes agentic workflows that touch release notes use update-release instead of direct GitHub mutations, preserving a read-only job model. It also lets cached-log commands merge matching JSONL shards, prune stale files and write collision-resistant results.→GitHub Agentic Workflows adds package-aware updates and safer model accountingThe release lets gh aw update target workflow packages individually and adds a Node network preset for the Impeccable Skills Reviewer. It also fixes Codex model identifiers and improves token, threat-detection and diagnostics reporting.→GitHub Agentic Workflows adds shared JavaScript modules for workflow packagesThe release supports .mjs and .cjs modules inside aw.yml packages with path-traversal and extension restrictions. It also coordinates rate-limit handling for multi-target logs and makes failed-run and evaluation credit accounting fail closed.→GitHub Agentic Workflows 0.88.7 tightens agent output and MCP policy handlingVersion 0.88.7 makes agent workflows fail when agents report incomplete work instead of silently succeeding, and restricts artifact packaging to known files. It also improves log-download tooling and filters disallowed repository-memory files before validation and upload.→GitHub Agentic Workflows adds grader audits and hardens MCP executionThe release adds daily grader-audit workflows, cross-run audit clustering, and pattern analysis to its logs and audit commands. It also tightens label permissions, MCP gateway readiness, fork pull-request safe-output handling, scanner argument handling, and dependency security gates.→GitHub Agentic Workflows tightens safe outputs and reproducibilitygh-aw v0.87.4 makes compilation fail when safe-output step-output tokens cannot resolve, adds pinned Agent Plugins, and supports per-engine model overrides and custom providers. It also stops `GH_TOKEN` persisting in repo-memory clone `.git/config` and derives conclusion-job write permission from resolved safe-output configuration.→GitHub's Copilot Cloud Agent status visibility degraded for hoursGitHub's status page said Copilot Cloud Agent tasks were still completing, but newly started tasks did not show ongoing progress and session output was delayed by about an hour. GitHub reported gradual recovery during the window and marked the incident resolved at 00:37 UTC on 21 August.→GitHub brings enterprise-managed Copilot settings to JetBrainsAdministrators can govern plugin and marketplace use, MCP server access, OpenTelemetry configuration, and permission modes. The controls can disable bypass or autopilot behaviour and restrict which plugins, marketplaces, and MCP servers developers may use.→GitHub adds organisation-level Code Quality trendsThe dashboard now plots open findings over 7-, 14-, or 30-day periods and ranks repositories by changes. It respects existing filters and is available to eligible GitHub Enterprise Cloud and Team organisations using Code Quality, but not GitHub Enterprise Server.→GitHub expands credential revocation by token typeOrganisations can now revoke or deauthorise credentials by token type and user, covering personal access tokens, SSH keys, OAuth app tokens, and GitHub App user tokens. The update adds organisation-level UI and API parity together with audit-log and email notifications.→GitHub outage disrupted repository downloads and CopilotGitHub opened the incident at 13:40:03 UTC after failures affected GitHub.com services, with repository-content downloads later reported at roughly a 50% error rate. The status page continued to record Copilot authentication failures and residual impact during the window.→