Approval Gates for Code You Didn't Write

No single GitHub release yesterday or today was large enough to warrant its own post. Five of them landed inside about 24 hours, though, and they are all the same shape: a control being placed between something automated and the code it is allowed to touch. Here is what shipped and what each one costs you.

What shipped

Actions holds suspicious workflows for a human. Dated July 28, this change stops a workflow GitHub flags as potentially malicious from running until a repository collaborator with write access reviews and approves it from an authenticated web session. It applies automatically to public repositories on github.com, needs no configuration, and is not available on GitHub Enterprise Server. The threat model named is compromised credentials pushing a workflow that steals CI/CD credentials. Why it matters: your public repos gained a blocking human step you did not schedule, and no one on your team owns that approval queue yet.

Dependabot malware alerts widen. Also July 28, GitHub is ingesting the OpenSSF malicious-packages advisories into the GitHub Advisory Database, pushing malware coverage past npm and PyPI into more ecosystems. If malware alerting is already on, nothing changes on your side and new advisories alert on publication. You can browse the set at github.com/advisories with the type:malware filter. Why it matters: the alert volume on your polyglot repos is about to go up without anyone changing a setting.

The Copilot app gets its own access policy. From July 27, the app is no longer governed by the Copilot CLI policy. It has a dedicated control under enterprise or organization settings, in the AI Controls tab under Copilot Clients, with three states: enabled everywhere, disabled everywhere, or let organizations decide. The default is enabled everywhere. Why it matters: a policy you previously set once now has a second surface, and that surface shipped open.

Managed settings reach the app and the cloud agent. Same day, managed-settings.json — already the governance file for Copilot CLI and VS Code — now applies to the Copilot app and the cloud agent. It lives at copilot/managed-settings.json in a .github-private repository on the default branch, and it controls which plugins and marketplaces are permitted, whether developers can bypass approval prompts, and the auto model selection default for new conversations. The app reads it on sign-in or restart, the cloud agent on the next task assignment, and changes generally propagate within an hour. Why it matters: agent policy is now a commit with a review, a rollback, and a propagation delay — treat it as production config, not a settings page.

JetBrains exports agent telemetry. The July 27 JetBrains release adds OpenTelemetry export configuration for agent workflows under Settings > Tools > GitHub Copilot > Chat, plus maxInputToken and maxOutputToken defaults for custom endpoints and BYOK models and the ability to disable specific built-in models. Why it matters: this is the first of the five that gives you evidence rather than a gate.

The thread, and the asymmetry inside it

Read as a set, four of these put a control between automation and code, and the fifth tells you what the automation did. What separates them is not the mechanism. It is the default.

The two covering GitHub's own execution surface — the Actions approval hold and the advisory ingestion — arrive on and automatic, with nothing for you to do. The three covering your agents arrive open or absent: the app policy defaults to enabled everywhere, the managed settings file has to be created in a repository most organizations have never made, and the telemetry export is a per-IDE setting each developer would otherwise never touch.

That split is the part worth acting on. A control that ships on is a control; a control that ships as an empty repository you have not created is a plan. And the surface it covers is real — an agent running with your plugins, your endpoints, and your token budget, inside an IDE nobody audits. This is the failure mode we keep writing about in a smaller frame: the capability ships, the operational scaffolding lands later and off by default, and the difference is charged to whoever is holding the incident. It is why enterprise AI doesn't ship on the schedule anyone forecasts.

Two concrete moves this quarter, both cheap. Create the .github-private repository and commit a near-empty copilot/managed-settings.json now, before you need a policy in a hurry — the propagation delay means the day you want a rule enforced is the wrong day to be creating a repository. And point the JetBrains OpenTelemetry export at the collector that already receives your application traces, so agent activity lands where your incident review already looks. Telemetry you have to go find during an incident is telemetry you do not have, which is the part of going from proof-of-concept to production that nobody budgets for.