#github-actions - November 2025

Upcoming deprecation of CodeQL Action v3
On October 7, 2025, we released CodeQL Action v4, which runs on the Node.js 24 runtime. CodeQL Action v3 will be deprecated at the same time as GHES 3.19, which…
The post Upcoming deprecation of CodeQL Action v3 appeared first on The GitHub Blog.

New releases for GitHub Actions – November 2025
Increased limits for reusable workflows You can now use up to 10 nested reusable workflows and call up to 50 workflows in total from a given workflow run. The previous…
The post New releases for GitHub Actions – November 2025 appeared first on The GitHub Blog.

Actions pull_request_target and environment branch protections changes
GitHub is updating how GitHub Actions’ pull_request_target and environment branch protection rules are evaluated for pull-request-related events. These changes will take effect on 12/8/2025. They aim to reduce security critical…
The post Actions pull_request_target and environment branch protections changes appeared first on <a href="https://github.blog/">The GitHub...

I think there is a bug (or at least some documentation that I may be missing and it's just PEBKAC) around the cloudposse/github-action-docker-build-push action. I've created the bug tracking it here https://github.com/cloudposse/github-action-docker-build-push/issues/86

New GitHub Actions OIDC token claims
GitHub Actions OpenID Connect (OIDC) token claims now include check_run_id This enhancement enables fine-grained, attribute-based access control and improves auditability for workflows that integrate with external services. Platform teams often…
The post New GitHub Actions OIDC token claims appeared first on The GitHub Blog.

GitHub Actions cache size can now exceed 10 GB per repository
GitHub Actions cache size can now exceed 10 GB per repository You can now store more build dependencies between workflow runs with expanded GitHub Actions cache storage. Repositories can go…
The post GitHub Actions cache size can now exceed 10 GB per repository appeared first on The GitHub Blog.

Code scanning default setup bypasses GitHub Actions policy blocks
GitHub code scanning default setup now runs even if your organization has GitHub Actions policies that restrict which workflows can run. In the past, restrictive actions policies could block code…
The post Code scanning default setup bypasses GitHub Actions policy blocks appeared first on The GitHub Blog.

In a github action for atmos-terraform-plan we have this section:

  atmos-plan:
    needs: ["atmos-affected"]
    if: ${{ needs.atmos-affected.outputs.has-affected-stacks == 'true' }}
    name: Plan (${{ matrix.name }})
    uses: ./.github/workflows/atmos-terraform-plan-matrix.yaml
    strategy:
      matrix: ${{ fromJson(needs.atmos-affected.outputs.stacks) }}
      max-parallel: 1 # This is important to avoid ddos GHA API
      fail-fast: false # Don't fail fast to avoid locking TF State
    with:
      stacks: ${{ matrix.items }}
      atmos-version: ${{ vars.ATMOS_VERSION }}
      atmos-config-path: ${{ vars.ATMOS_CONFIG_PATH }}
      sha: ${{ github.event.pull_request.head.sha }}
    secrets: inherit

Is the limit of 1 really that strict?

 max-parallel: 1 # This is important to avoid ddos GHA API

and in atmos-terraform-plan-matrix.yaml we have max-parallel: 10... so is it 1 or 10?

@Igor Rodionov