GitHub refreshes the pull requests page and hardens Actions caching
The Sept 10 platform drop: advanced PR search, least-privilege cache controls, a new AI Scan REST API, and a Copilot model quietly retired.
Copy markdown
The PR page finally gets real search
GitHub's refreshed pull requests page (public preview) adds content-assist filters and advanced search with AND/OR and nested queries, plus a collapsible sidebar and a compact mode showing status-check counts, stack indicators, and unread markers. Milestones, bulk edits, and saved views aren't in yet — you can flip back to classic anytime.
Actions cache-mode shuts a poisoning door
A new cache-mode sets least-privilege cache access per workflow or job — read, write, write-only, or none — defaulting to read for untrusted events like pull_request_target and write for push. It's GA on all plans, and called workflows can't exceed the caller's permission, making cache poisoning much harder to pull off.
Flip on AI security scans by API, not clicks
Two new endpoints — /orgs/{org}/code-scanning/ai-scan and the repo equivalent — let you read and toggle AI Scan for pull requests org- or repo-wide without configuring each repo in the UI. It's public preview, GitHub Advanced Security only, and not supported on Enterprise Server.
Copilot retires MAI-Code-1-Flash
MAI-Code-1-Flash is deprecated across Copilot Chat, inline edits, ask and agent modes, and code completions; the successor is MAI-Code-1.1-Flash. It won't switch over automatically — enterprise admins must enable the new model in Copilot policies, so check yours before pinned workflows fall back.
Xcode 27 runners move to macOS 27
The xcode-27 GitHub-hosted runner now boots macOS 27 in public preview, so you can validate Apple apps against the new OS using the same runs-on: xcode-27 label. One catch: this image is arm64-only.
Elsewhere: Codex can read your business data
OpenAI added a Data plugin that lets Codex and ChatGPT Work analyze connected business data, and put Box, Dropbox, and SharePoint into the ChatGPT Library — so your coding agent can pull context straight from company docs.