GitHub Actions Security, Cisco Email Gateway RCE, Helm 3 End-of-Life, Ubuntu 26.04 Runners & Why “Nothing Changed” Is Never the Whole Story

This week on Ship It Weekly: GitHub Actions workflow execution protections are now generally available, giving organizations more control over who and what can trigger individual workflows. Cisco is patching critical vulnerabilities in Secure Email Gateway, including an actively exploited issue that can lead to remote command execution as root. Helm 3 has reached its final minor release and is heading toward end-of-life in February 2027. And GitHub’s ubuntu-latest Actions runner is preparing to move from Ubuntu 24.04 to 26.04. The bigger theme this week is infrastructure that changes even when your code does not. GitHub is making CI execution permissions more explicit, Helm teams now have a defined migration deadline, and the ubuntu-latest transition is a good example of how a completely unchanged workflow can suddenly be running in a different environment. Pinning everything forever is not necessarily the answer. The important part is knowing which dependencies are allowed to move and testing those changes deliberately. In the lightning round: GitHub Actions checks, workflow runs, and statuses will begin following your configured retention period on October 1. GitHub Advanced Security can now enforce configurations from the enterprise level. GitHub added API support for tracking when self-hosted Actions runner versions lose support. And AI Scan for pull requests can now be used without requiring CodeQL default setup. And the human closer starts with a sentence almost every infrastructure engineer has heard during an incident: “But nothing changed.” Maybe nothing changed in the application, but the runner image changed, a dependency moved, a certificate expired, DNS changed, or an external service behaved differently. Latest tags, loose version constraints, external APIs, and even support windows are dependencies. The goal is not to freeze everything forever. It is to avoid accidental mutability, where something can change without the team realizing it was ever allowed to change. Links GitHub Actions Workflow Execution Protections https://tsn.io/fbqif Cisco Secure Email Gateway Security Advisory https://tsn.io/jX2wk Helm 3 End of Life https://tsn.io/Ii7jb Ubuntu 26.04 GitHub Actions Runners and ubuntu-latest Migration https://tsn.io/7IJ9k GitHub Actions Retention Changes https://tsn.io/idFxy GitHub Advanced Security Configuration Enforcement https://tsn.io/8vRMx GitHub Actions Self-Hosted Runner Lifecycle API https://tsn.io/9UhY1 GitHub Code Scanning AI Scan https://tsn.io/ULAVW This Week’s On Call Brief https://www.tellerstech.com/go/26w38/ Ship It Weekly https://tsn.io/NqkdP On Call Brief https://tsn.io/Gpz2d