GitHub Actions in fall 2026: six dated changes to check in your CI pipelines

GitHub has scheduled a cluster of GitHub Actions changes for fall 2026. Three are already in effect. On September 23, 2026, GitHub gave final notice that Node 20 is no longer available on runners. On September 29, minimum version enforcement for self-hosted runners began on GitHub Enterprise Cloud. On October 1, run history started to expire on the same schedule as artifacts and logs. Three more changes land between October 19 and November 19, 2026.

A runner is the machine that executes a workflow job. Self-hosted runners are ones you operate yourself. Each change below can fail a job or remove records without anyone editing a workflow file.

Already in effect

Node 20 is gone. Runners now use Node 24 for JavaScript actions, and the temporary ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out is no longer available. Node 24 is incompatible with macOS 13.4 and earlier and does not officially support ARM32, so self-hosted runners on those systems are no longer supported.
Self-hosted runner versions are enforced on GitHub Enterprise Cloud. Runners below version 2.329.0 cannot register or reregister. Existing runners below the minimum version for running jobs, which is higher than the registration minimum, stop running jobs. GitHub's June timeline says to install each new runner release within 30 days of its publication. GitHub Enterprise Server is not affected.
Run history expires. On github.com, checks, workflow runs, and statuses now follow the same retention setting as artifacts and logs, including checks and statuses created by third-party applications. GitHub's August notice gives a default of 90 days, where these records were previously retained for 400 days or more. Public repositories have a maximum of 90 days.

Coming between October 19 and November 19

The ubuntu-latest label migrates from Ubuntu 24.04 to Ubuntu 26.04, gradually, between October 19 and November 19, 2026. GitHub warns that the migration may break builds. The Ubuntu 26.04 image updates some tools and removes others.
The macOS 14 runner image retires on November 2, 2026. The labels macos-14, macos-14-large, and macos-14-xlarge are affected. Jobs on macOS 14 will fail temporarily during scheduled brownouts. The first runs from October 5, 14:00 UTC to October 6, 00:00 UTC, and seven more follow, the last starting on October 30.
The pull_request_target trigger is blocked by default on some public repositories from November 2, 2026 (see below).

The security change: pull_request_target

On September 17, 2026, GitHub made workflow execution protections generally available for enterprises, organizations, and repositories. These are allowlist rules that control who can trigger a workflow (actor rules) and which events can start it (event rules). An evaluate mode shows which runs a rule would block before you enforce it.

With that release, GitHub added a default rule that disables the pull_request_target trigger for public repositories that do not already have an applicable event policy. GitHub's stated reason is that this trigger runs with access to secrets in the context of the base repository, so untrusted code from a fork could poison the pipeline and exfiltrate secrets. The default rule starts in evaluate mode. GitHub will enforce it automatically on November 2, 2026 for affected repositories. It does not apply to private or internal repositories.

What to do this month

Move macos-14 labels to a current label such as macos-15 or macos-latest, which GitHub lists as macos-26.
Test every job that uses ubuntu-latest against ubuntu-26.04 now, or pin it to ubuntu-24.04 until you are ready.
Update the JavaScript actions your workflows call to versions that support Node 24. If you maintain your own, set runs.using to node24 and publish a new release.
Upgrade self-hosted runners, along with the installation scripts, VM images, and container images that build them. GitHub's REST API for runner version deprecations returns the registration and runtime deprecation dates for a runner version.
Review the Actions retention setting for each enterprise, organization, and repository. If check results or run history serve as audit evidence, export or archive what you need beyond the retention period. Changing the setting does not restore data already removed.
For public repositories, see which pull_request_target runs the default rule would block, then decide before November 2 whether to keep the block or allow the trigger explicitly in an Actions event policy.