GitHub Actions Ties Copilot Code Reviews to CI/CD Minutes from June 1, 2026

Starting June 1, 2026, GitHub activated a pivotal billing change: every automated Copilot Code Review triggered on a private repository now consumes GitHub Actions minutes from the organization's existing plan entitlement. The shift affects all Copilot subscribers — from individual Pro and Pro+ plans to Business and Enterprise tiers — and marks the deepest structural integration yet between GitHub's AI layer and its CI/CD infrastructure.

Until May 31, 2026, Copilot code reviews drew exclusively from the premium request unit allowance bundled with each Copilot subscription. That model kept AI-driven review costs predictable and siloed from pipeline compute budgets. Under the new model, every automated code review spawns an Actions workflow on the repository's runner, making Copilot reviews subject to the same billing mechanics as any other CI job. According to GitHub's official changelog announcement from April 27, 2026, the billing scope is broader than many teams expected:

"This includes Copilot code reviews from non-licensed users and billed via direct org billing."

The wording carries important implications: even if a developer without an assigned Copilot license triggers a review through a non-licensed pathway, the resulting Actions minutes are still charged to the organization. For companies that have broadly enabled Copilot Code Review across large engineering organizations — with hundreds or thousands of active developers — the cumulative cost impact could be material and, in many cases, unexpected. Engineers working on private repositories across all four affected plan tiers must now factor Copilot review activity into their Actions compute budgets, something that required no consideration at all before June 1.

Who Is Affected and Who Is Exempt

Public repositories are fully exempt. GitHub Actions minutes for public repos remain free, and Copilot code reviews on open-source projects will not consume any billable minutes. For the vast majority of enterprise teams operating on private repositories, however, the June 1 activation introduced a new cost variable that engineering leadership and billing administrators must now incorporate into DevOps budgets.

GitHub provides per-runner-type billing rates, and Copilot reviews inherit those distinctions based on which runner type the workflow uses — standard GitHub-hosted runners, larger runners, or self-hosted runners each carry different per-minute rates. Organizations were advised to take the following steps ahead of the change:

• Audit current Actions usage dashboards and establish a cost baseline before June 1
• Confirm spending limits and budgets to accommodate the combined Copilot-and-Actions footprint
• Communicate the new billing model to engineering leads and billing administrators
• Monitor Copilot and Actions metrics jointly in the weeks following the rollout to detect unexpected cost spikes

For organizations running self-hosted runners for their CI/CD workloads, Copilot reviews on those runners will consume minutes at self-hosted rates — currently not subject to the cloud platform charge (see below) — providing a potential cost optimization path for high-volume code review scenarios.

GitHub Actions Pricing Overhaul: Hosted Runners 39% Cheaper and New Features Deployed

The Copilot billing change did not arrive in a vacuum. It followed the most aggressive repricing of GitHub-hosted runners in the platform's history, which took effect January 1, 2026, and a series of workflow-level feature additions in the first quarter of 2026 that collectively reposition GitHub Actions as a more competitive and cost-effective CI/CD platform relative to Jenkins-based infrastructure.

Hosted Runner Price Reductions

According to GitHub's official January 2026 changelog, the price cuts across runner types were substantial:

• Linux 2-core: from $0.008 to $0.006 per minute — a 25% reduction
• Windows 2-core: from $0.016 to $0.010 per minute — a 37.5% cut
• macOS: from $0.080 to $0.062 per minute — approximately 22% savings

GitHub attributed these reductions to a major re-architecture of the Actions compute layer, which delivered faster startup times and improved reliability alongside the cost savings. A new $0.002 per-minute Actions cloud platform charge was introduced simultaneously. Critically, the net listed runner rates already include this charge, so the headline prices above are all-in figures. The cloud platform charge does not apply to public repositories or GitHub Enterprise Server deployments.

Self-Hosted Runner Charge Paused After Community Backlash

A separate pricing episode created significant friction in the DevOps community: GitHub initially announced a $0.002 per-minute charge for self-hosted runners in private repositories, originally scheduled to begin March 1, 2026. Following substantial community pushback, GitHub postponed that charge indefinitely in December 2025. As documented by Hands-on Programming in March 2026, self-hosted runners remain free of the platform fee as of June 2026. The episode underscored both the sensitivity of the DevOps community to changes in runner economics and GitHub's capacity to respond quickly to developer pressure — a dynamic that contrasts sharply with the historically slower governance cycles of Jenkins, which operates under open-source community consensus.

New Workflow Features in Q1 2026

GitHub's March 19, 2026 changelog update introduced two quality-of-life improvements that developers had long requested and that reduce unnecessary overhead in CI/CD workflows:

1. Environments without auto-deployment: Workflows can now use environments — accessing their secrets and variables — without automatically creating a GitHub Deployment object. The new deployment: false key eliminates the unwanted Deployment entries that organizations relying on environments solely for secrets scoping had been forced to generate, cluttering deployment tracking dashboards.
2. IANA timezone support for cron schedules: Previously, all scheduled workflow triggers were locked to UTC. Now a timezone: "America/New_York" field (or any valid IANA timezone string) can be specified alongside the cron expression, removing the need for manual UTC offset calculations across global engineering teams and eliminating a persistent source of scheduling errors during daylight saving time transitions.

Additional recent additions include the macOS 26 Intel runner image in public preview for larger runners, accessible by setting runs-on: macos-26-large in workflow YAML files, providing teams with the latest macOS and Xcode tooling for Intel-based builds. A runner scale set client also moved to public preview: a standalone Go-based module that lets teams build custom autoscaling solutions for GitHub Actions runners without requiring a Kubernetes environment, opening self-managed scaling options to organizations that run their CI/CD on bare-metal or VM-based infrastructure.

OpenTofu 1.12.0: The Feature Terraform Never Shipped — Dynamic Infrastructure Control

On May 14, 2026, the OpenTofu community released version 1.12.0 — a release that immediately drew attention across the Terraform ecosystem because it delivered a capability that HashiCorp's own Terraform had long been requested to provide but never shipped: dynamic values in the prevent_destroy lifecycle argument. InfoQ described it as "the feature Terraform never shipped" in its May 2026 analysis, and the characterization resonated widely in the infrastructure-as-code community.

OpenTofu — the open-source fork of Terraform created after HashiCorp moved to the Business Source License in August 2023 — has been diverging from its parent project at an accelerating pace. Version 1.12.0 makes that divergence unmistakably visible at the configuration language level, in ways that directly affect how CI/CD pipelines built on GitHub Actions and Jenkins interact with infrastructure automation.

Dynamic prevent_destroy: Multi-Environment IaC Without Module Forks

The prevent_destroy argument in a resource's lifecycle block previously accepted only a static true or false literal. Engineering teams managing production and development infrastructure with shared Terraform modules had to either maintain separate module forks for each environment or build external tooling to work around the limitation. OpenTofu 1.12 eliminates the problem entirely: the argument can now reference input variables or other module-level symbols, enabling environment-aware destruction protection from within a single shared module.

resource "aws_rds_instance" "main" {
  # ...
  lifecycle {
    prevent_destroy = var.is_production
  }
}

With this pattern — as detailed in the official OpenTofu 1.12.0 release announcement — a single module can be deployed across production (where var.is_production = true blocks accidental destruction of critical databases) and development (where var.is_production = false permits teardown during testing). For CI/CD pipelines — whether built on Jenkins or GitHub Actions — that automate OpenTofu runs across environment-specific workspaces, this simplification reduces module maintenance burden and eliminates a category of environment-specific configuration drift that had previously required careful management.

Simultaneous Output Formats for CI/CD Pipeline Integration

A second major addition in 1.12.0 is the new -json-into=FILENAME CLI option, which enables concurrent output formats in a single command invocation. Engineers can run tofu plan or tofu apply and receive both human-readable terminal output displayed interactively and machine-readable JSON written simultaneously to a specified file or named pipe. This design has direct implications for CI/CD integration: pipelines built on Jenkins or GitHub Actions that parse OpenTofu output for downstream decisions — cost estimation, drift detection, approval gates, Slack notifications — no longer need to run the command twice or rely on fragile terminal output capture via shell redirects. Real-time JSON can be streamed directly to dashboard systems, IPC objects, or notification services as the plan or apply runs. As Spacelift noted in its May 2026 breakdown of OpenTofu 1.12, this feature alone is a meaningful improvement for teams building sophisticated CI/CD feedback loops around infrastructure changes.

Faster Provider Installation and Improved Checksum Handling

tofu init now makes concurrent requests to download provider packages rather than fetching them sequentially. For large infrastructure repositories with dozens of providers — common in enterprises managing multi-cloud environments — this meaningfully reduces the cold-start time of CI/CD pipelines. Every Jenkins build stage and GitHub Actions step that runs tofu init as part of a plan-apply workflow benefits from this parallelism without any configuration change.

Provider checksum handling was also improved: tofu init now automatically generates complete checksums for all platforms using both zh: and h1: hash formats, eliminating most scenarios where teams needed to manually run tofu providers lock to unblock colleagues on different operating systems or CI runner architectures. Cross-platform DevOps teams — where developers work on macOS, CI runs on Linux, and some pipelines target Windows — had routinely hit checksum mismatch errors requiring manual intervention; OpenTofu 1.12 makes this largely a non-issue.

New destroy Lifecycle Meta-Argument and Deprecations

A new destroy = false lifecycle meta-argument allows removing a managed resource from OpenTofu state without destroying the underlying remote object. This is valuable in migration scenarios where teams want to transfer ownership of infrastructure between OpenTofu workspaces, between tools, or to unmanaged state — without triggering cloud resource deletion. Previously this required manual state manipulation commands; it can now be expressed declaratively in the resource configuration.

Two deprecations accompany the release: WinRM support is deprecated in v1.12 with removal planned for v1.13 (migration to OpenSSH is recommended for Windows remote execution targets), and official 32-bit architecture builds (386 and arm) will be phased out, with v1.13 introducing deprecation warnings ahead of final discontinuation.

Terraform 1.15.6 Released Amid the Growing OpenTofu Divide

HashiCorp released Terraform 1.15.6 on June 10, 2026, the latest patch in the 1.15.x maintenance line. The release addresses specific operational issues: improved support for provider binary installation into symlinked directories during terraform init — a scenario common in enterprise environments where package management systems create symbolic links into shared provider caches — and the addition of Linux s390x (zLinux mainframe) build support, extending Terraform's reach to IBM mainframe environments where some large financial institutions run their automation pipelines.

The contrast between Terraform 1.15.6's incremental bug-fix profile and OpenTofu 1.12.0's language-level feature additions has become a recurring conversation across IaC practitioner communities. Both tools remain compatible for the vast majority of configuration use cases — the HCL configuration language is largely shared, and most modules written for one tool run on the other — but the feature velocity of the OpenTofu community is prompting CI/CD platform teams using GitHub Actions and Jenkins pipelines to formally evaluate which tool to standardize on for new infrastructure projects.

HashiCorp's Business Source License remains the defining differentiator at the commercial and legal level. Terraform is free for individual and organizational use but may not be used to build competing products without a commercial license from HashiCorp. OpenTofu, distributed under the Mozilla Public License 2.0, carries no such restriction — a distinction that matters for SaaS vendors building IaC platforms, internal platform engineering teams creating Terraform abstractions for their organizations, and CI/CD platform vendors seeking to integrate infrastructure automation into their toolchains. As the two projects continue to diverge at the language and feature level, the license difference increasingly compounds the technical differences in shaping long-term tool selection decisions.

Jenkins Security and Stability Updates Across May and June 2026

Jenkins, the open-source CI/CD automation server that continues to anchor enterprise pipelines at banks, telcos, chipmakers, and manufacturing conglomerates despite growing competition from cloud-native alternatives, shipped a series of notable updates across May and June 2026. The pace of feature innovation in Jenkins remains measured — the project's strength lies in its stability, plugin ecosystem, and on-premises deployment model — but its maintenance activity across this period reflects ongoing enterprise commitment and active security stewardship.

Jenkins 2.566: CSP Telemetry, Editor Fix, and Queue Performance

Jenkins 2.566, released May 26, 2026, addressed three distinct areas according to detailed release documentation:

• Extended Content Security Policy (CSP) telemetry (PR #26807): Provides Jenkins administrators and security teams with more granular data about which content security policies are active across the Jenkins instance. For organizations subject to regulatory requirements — financial services, healthcare, government — enhanced CSP observability directly supports compliance auditing and incident response workflows.
• Description editor bug fix (PR #26795): Resolved an issue where the description editor appeared empty on initial page load when configuring jobs or views. The bug had caused confusion and, in some cases, duplicate or overwritten configurations when administrators assumed the field was blank and re-entered content.
• Queue.maintain performance optimization (PR #26797): Introduced a cache for Util.isOverridden within the queue management subsystem, reducing CPU overhead when the task queue checks method override status during heavy load. For high-volume Jenkins deployments managing hundreds of concurrent jobs — typical in large enterprise environments — this optimization contributes measurably to queue responsiveness and overall build throughput.

Jenkins 2.567 and the June 10 Security Advisory

Jenkins 2.567, released June 2, 2026, included a targeted fix ensuring that URLs in widgets loaded via AJAX are correctly resolved — addressing a navigation regression in the Jenkins web UI that had affected certain dashboard configurations. A Jenkins security advisory issued June 10, 2026 addressed additional vulnerabilities across Jenkins core and the plugin ecosystem, consistent with Jenkins' rolling security disclosure cadence. The advisory serves as a reminder that the project's security posture is actively maintained and that plugin-level vulnerabilities — historically a significant attack surface in Jenkins deployments — continue to receive structured public disclosure and patching.

Windows MSI Installer Signing Transition to Linux Foundation

Perhaps the most operationally significant Jenkins milestone of the period was the Windows MSI installer signing transition announced by Jenkins core contributor Mark Waite on April 29, 2026. Effective Jenkins weekly release 2.562 (April 28, 2026) and LTS release 2.555.2 (May 13, 2026), the Windows installer is now signed via the Linux Foundation's Microsoft Artifact Signing Service, with certificates issued under "LF Open Source, LLC."

The transition was necessitated by the expiration of the previous code-signing certificate on May 16, 2026. The Linux Foundation provided a proven methodology: it already uses the same Microsoft Artifact Signing Service approach for the NodeJS Foundation, giving Jenkins maintainers a well-tested and auditable blueprint to follow. The immediate user-facing consequence is temporary Microsoft Defender SmartScreen warnings during installation — Edge browser downloads flag the installer as infrequently downloaded and prompt users to click "Keep anyway"; the installer launch itself displays a "More info / Run anyway" flow — while the new certificate accumulates the installation history needed to build SmartScreen reputation. These prompts are expected to diminish over weeks as the certificate's reputation grows.

For enterprise IT organizations distributing Jenkins via Mobile Device Management systems, SCCM, or Group Policy — where code-signing certificate trust is managed centrally and blocked certificates can halt automated deployments — the transition required updating publisher trust policies to recognize "LF Open Source, LLC" before the May deadline. Teams running automated Jenkins installation pipelines on Windows, including those orchestrated by GitHub Actions workflows or Jenkins-on-Jenkins bootstrap jobs, needed to accommodate the temporary SmartScreen behavior in their installation scripts.

The Windows signing transition also highlights a broader pattern: Jenkins infrastructure decisions increasingly involve the Linux Foundation, which has taken on a more active role in Jenkins governance and infrastructure over recent years. The relationship provides Jenkins with institutional backing and access to enterprise-grade tooling — such as the Microsoft Artifact Signing Service — that would be difficult for the project to obtain independently. It parallels the Linux Foundation's role in providing OpenTofu its home after the HashiCorp license change, suggesting the foundation is becoming a central node in the open-source CI/CD and IaC ecosystem.

Taken together, the period spanning May and June 2026 represents a moment of unusual simultaneous activity across the three pillars of the modern DevOps toolchain: GitHub Actions is reshaping its economics by tying AI-driven code review to CI/CD compute budgets; OpenTofu is extending its lead over Terraform at the language feature level with capabilities that directly simplify multi-environment pipeline automation; and Jenkins is reinforcing its enterprise foundation through security, performance, and platform trust improvements. For DevOps and platform engineering teams, the convergence of these changes in a single six-week window makes mid-2026 a natural inflection point for re-evaluating CI/CD toolchain strategies.

Fuentes

• GitHub Copilot code review will start consuming GitHub Actions minutes on June 1, 2026 (GitHub Changelog)
• Reduced pricing for GitHub-hosted runners usage — January 2026 (GitHub Changelog)
• GitHub Actions: Late March 2026 updates (GitHub Changelog)
• GitHub Actions Is Changing Its Pricing – What Actually Happened (Hands-on Programming)
• OpenTofu v1.12.0 Release Announcement (OpenTofu Blog)
• OpenTofu 1.12: the Feature Terraform Never Shipped (InfoQ)
• OpenTofu 1.12.0: Safer Environments, Faster Init, Less Toil (Spacelift)
• Terraform Releases — hashicorp/terraform (GitHub)
• Jenkins 2.566 Update: CSP Telemetry, Editor Fixes, Performance (Yuri Kan Blog)
• Jenkins 2.562 and 2.555.2: Signed by LF Open Source, LLC (Jenkins Blog)