November roundup: Markdown linking, a sharper theme, and project tab control

The November GitHub changelog cycle focused on several quality-of-life improvements across the platform, ranging from Markdown authoring conveniences to interface customization and project management flexibility.

Linkify text with a simple paste

Creating hyperlinks in Markdown has been streamlined. You can now copy a URL, select the text you want to turn into a link, and press Ctrl/Cmd + V to instantly format the selected text as a Markdown link—no manual bracket and parenthesis typing required.

Light high contrast theme

A new light high contrast theme is now available in beta. This theme increases the contrast ratio between foreground and background elements, which improves readability for text and UI components alike. It’s a useful option for users who need stronger visual differentiation or prefer a more pronounced interface in bright environments.

Tab reordering in GitHub Projects

After community requests, the new GitHub Projects interface (in beta) now supports dragging to reorder tabs. This applies to the tabbed layout within a project, giving you more control over the sequence of views you work with most frequently.

Markdown, Gists, and accessibility updates

GitHub Gist now offers Markdown previews while editing, matching the rendering experience on GitHub.com. A "Preview" or "Preview changes" tab will display the rendered output of your file content.

For users of assistive technologies such as voice input, keyboard shortcuts that rely on single characters (like the period key) can now be disabled to prevent accidental triggers. This option is managed from a new accessibility settings page.

Native support for right-to-left languages has been added across Markdown files, issues, pull requests, discussions, and comments. Organization owners can also unsubscribe from email notifications when new deploy keys are added to repositories in their organizations.

Actions expands with reusable workflows, caching, and OIDC

Reusable workflows have reached general availability, letting you reuse an entire workflow as a single action to reduce duplication. The setup-python action now supports dependency caching for both pip and pipenv projects, which can speed up Python workflow runs. Cache size has also doubled to 10GB per repository.

Several additional Actions capabilities arrived this month:

  • Manually triggered workflows now support choice, boolean, and environment input types in addition to the default string.
  • Composite actions written in YAML support conditional execution of steps via if conditionals.
  • Workflows can run when branch protection rules change on a repository.
  • OpenID Connect support for securing cloud deployments is generally available, allowing workflows to request short-lived, automatically rotated access tokens.
  • Actions workflows triggered by Dependabot receive Dependabot secrets.
  • Windows Server 2022 with Visual Studio 2022 is now generally available on GitHub-hosted runners.

APIs, enterprise, and compliance

For self-hosted runners, you can now list, add, and remove runner labels via the API. The expiration dates of SAML-authorized personal access tokens are also retrievable via API.

GitHub's 2021 SOC 1, Type 2 and SOC 2, Type 2 compliance reports are available to GHEC admins in the "Compliance" tab of their enterprise account at https://github.com/enterprises/"your-enterprise"/settings/compliance. For organizations, the reports appear under the "Organization Security" tab at https://github.com/organizations/"your-org"/settings/security.

Other enterprise-related changes:

  • Team sync for Okta is now generally available.
  • Custom footers with links of your choosing can be configured and are visible to everyone in the organization.
  • Standalone organizations paying by invoice can upgrade to an enterprise account via an in-product self-service flow.

Issues, mobile, and pull request workflows

The @mention suggester now ranks participants in issues, pull requests, and discussions above non-participants, making it easier to find the intended person.

Organization admins can now moderate disruptive behavior from GitHub Mobile. From the comment menu on an issue, pull request, or discussion, tapping Block from organization blocks the user and hides their comments. Push notifications are now supported for pull request review activities, alerting you when someone approves, comments, or requests changes.

Branch protection rules can now require pull requests for changes without also requiring reviews. This is useful for tracking or CI simplification without making merging contingent on review. Admins can also allow specific users and teams to bypass required pull requests, and notifications for pull request reviews can be configured independently from auto-assignment.

Pages, repositories, and theming

Custom GitHub Pages domains can now be verified to guard against domain takeover attacks. Repository invitations have also been improved: private repository invites now generate notifications, pending invites to private repos show an accept prompt instead of a 404 page, and a banner indicates pending invites on public repositories. The repository sidebar now highlights a CODE_OF_CONDUCT.md file, and custom autolinks can use single-character prefixes.

In Markdown, you can now specify whether an image is shown to light or dark theme users by appending #gh-dark-mode-only or #gh-light-mode-only to the image URL.

Security and CodeQL expansions

CodeQL code scanning now recognizes more Python libraries and frameworks, and additional Java and JavaScript libraries. Java coverage now spans more than three times the endpoints of earlier CodeQL versions, and JavaScript analysis supports most common templating languages. With the latest CodeQL CLI, you can include Markdown-rendered query help in SARIF files for custom queries, which will display in code scanning.

Debugging CodeQL scans is easier via an optional Actions workflow flag that uploads diagnostic artifacts — including CodeQL logs, databases, and SARIF files — to the Actions run. CodeQL now also runs natively on Apple Silicon (M1) machines via the CLI and Visual Studio Code extension.

Additional security updates:

  • Advanced Security license usage data can be exported as a CSV file.
  • Code scanning alerts now integrate with GitHub Issues task lists (beta).
  • Dependabot alerts can be dismissed via API.
  • Meta is now a GitHub secret scanning partner.

Sponsors

Sponsors can now see which links their sponsors came from by adding custom parameters to sponsorship URLs.