GitHub Actions Update: Key Changes for Developers in 2025

2025-02-13

As GitHub evolves, there are a number of significant updates on the horizon that will affect developers using GitHub Actions. These changes, which will take effect in 2025, include updates to check run status modification, migration to immutable actions for hosted runners, self-hosted runner network allow list updates, and scheduled brownouts related to Ubuntu 20. This article will break down these changes, offering you the crucial details on what you need to know and what actions you might need to take.

Key Updates

Changes to Check Run Status Modification: Starting March 31, 2025, GitHub will no longer allow developers to modify the status or conclusion of check runs created by GitHub Actions from a different workflow run using the GitHub token. This is part of GitHub’s push to enhance the security and trustworthiness of check run results. Impacted workflows will show annotations starting February 17, 2025.
Migration to Immutable Actions: In preparation for the February 2025 public preview of Immutable Actions, GitHub is migrating standard hosted runner customers to use immutable actions. This transition requires no action on the user’s part, as GitHub will default to immutable actions when available, while traditional action resolution will be used in the absence of immutable actions.
Updates to Self-Hosted Runner Allow Lists: If you’re using self-hosted runners, you’ll need to ensure that your network allow lists are updated to accommodate traffic related to immutable actions. This includes allowing traffic to pkg.actions.githubusercontent.com and ghcr.io for future immutable action updates. If you’ve already allowed .actions.githubusercontent.com, no further action is needed.
GitHub Enterprise Server & Azure Networking Updates: Self-hosted runners that use GitHub Connect or Azure private networking may need to update their network configurations. New IP addresses have been added to the necessary NSG template for Azure.
Ubuntu 20 Image Deprecation: Starting March 2025, GitHub Actions will begin failing jobs that reference the ubuntu-20.04 label. Temporary “brownouts” for Ubuntu 20 will occur at specified times in March 2025, raising awareness of the imminent removal of this image.

What Undercode Says: Analyzing GitHub Actions Updates

As we look ahead to these significant changes in GitHub Actions, there are a number of insights to consider about their potential impact on developers and workflows. The most notable of these updates are the changes to check run status modification and the transition to immutable actions for hosted runners.

The decision to disallow modifying the status or conclusion of check runs from a different workflow run starting in 2025 is a clear response to security concerns. By limiting who can modify check run results, GitHub aims to ensure that the conclusions of automated checks are more trustworthy and not susceptible to manipulation from unauthorized sources. For developers, this change underscores the growing importance of security within CI/CD pipelines and GitHub’s increasing efforts to maintain the integrity of its ecosystem. Workflows that were previously able to dynamically alter check statuses will need to be reworked to align with these new restrictions. As GitHub has already announced, annotations will be provided to affected workflows in mid-February 2025, giving developers time to adjust and avoid disruptions.

The shift to immutable actions also marks a pivotal moment in GitHub’s evolution. Immutable actions offer the promise of improved security and consistency. In essence, immutable actions are read-only actions that cannot be altered once they’ve been published. This ensures that the code and functionality of these actions remain unchanged, reducing the risks associated with dependencies on constantly evolving actions. This is an important change, especially for developers who rely on external actions for their workflows. For those working with self-hosted runners, it’s critical to ensure that the necessary network configurations are updated to allow traffic to the domains hosting these immutable actions. Failure to do so may prevent your workflows from completing successfully, resulting in job failures. However, GitHub’s approach of defaulting to traditional actions when immutable ones are unavailable ensures that developers won’t face issues if they haven’t yet updated their runner configurations.

One key consideration for enterprises using self-hosted runners is the update to network allow lists. With the of immutable actions and changes to the associated domains, it’s essential to stay on top of these changes to ensure smooth operation. GitHub has provided detailed guidance on which domains need to be allowed in your firewall, and failure to do so could lead to disruptions in your CI/CD pipelines.

The upcoming brownouts for Ubuntu 20 are another key update developers should keep in mind. As the removal of Ubuntu 20 looms in March 2025, developers who rely on the ubuntu-20.04 label in their workflows should take action to migrate their workflows to a supported version. The scheduled brownouts in March are designed to help raise awareness and give developers a heads-up, but they also serve as a reminder of the lifecycle of the images GitHub provides. Ubuntu 20’s deprecation reflects the broader trend of moving to newer, more secure, and optimized images. By updating your workflows now, you can avoid the disruptions caused by the eventual removal of this image.

In conclusion, GitHub’s upcoming changes are a part of a broader trend towards enhancing security, reliability, and consistency within its Actions platform. For developers, staying ahead of these changes will be essential to maintaining smooth, uninterrupted workflows. By ensuring your network configurations are up to date, migrating your workflows to compatible versions, and adjusting to the new check run status policies, you can ensure that your use of GitHub Actions remains efficient and secure.

References:

Reported By: https://github.blog/changelog/2025-02-12-improved-pull-request-merge-experience-enabled-by-default-in-public-preview
https://www.linkedin.com
Wikipedia: https://www.wikipedia.org
Undercode AI: https://ai.undercodetesting.com