GitHub package firewall in public preview
Summary
GitHub announces a public preview of a package firewall that sits between CI/CD endpoints (like Actions runners) and upstream package registries. It inspects metadata requests and downloads for signs of malicious activity, with policy controls, advisory database checks, and supply-chain attestation features; currently npm packages are supported, and the service is free during the preview for GitHub Enterprise Cloud customers.