Skip to content

November 5, 2026

  • Uploads from pull requests from forks. GitHub Actions doesn’t give secrets or OIDC tokens to jobs in pull requests from forks, so their reports used to need a second workflow in the base repository to upload them. Now a project Editor can turn on Allow uploads from forks on the project’s Access page and add the flakiness/authenticate-fork-prs action before the test step. The action gets the job an upload token that expires after 6 hours, and the reporter uploads from the regular test workflow. Anyone who can open a pull request can then upload reports, so the setting is off by default. Existing two-workflow setups keep working. See GitHub Actions for Open Source Projects.

  • Project transfer. Organization admins can move a project to another organization where they are also an admin, from the Danger Zone of the project settings. Reports, settings, the access token, and project collaborators move with the project, and the plan of the new organization applies to it. CI that authenticates with OIDC needs flakinessProject changed to the new address.