The first half of 2026 rearranged three things at once for teams that live in GitHub Actions: what CI costs, how it is secured, and how much of it a machine can now do on its own. None of these landed cleanly. Prices went down for most people while a new platform charge quietly went up. A self-hosted runner fee was announced, met a wall of objections, and was pulled back within a week. And a security roadmap arrived that will change how workflows pin dependencies and scope secrets over the next two to three quarters.
Here is a grounded read of what happened, with sources, and an honest account of where Latchkey fits.
Hosted runners got cheaper, and a new platform charge arrived
On January 1, 2026, GitHub reduced GitHub-hosted runner prices by up to 39%, with the size of the cut depending on the machine type (larger runners saw the larger relative reductions), per GitHub's own changelog (github.blog). In concrete terms, community reporting put the Linux 2-core rate moving from $0.008 to $0.006 per minute and the Windows 2-core rate from $0.016 to $0.010 per minute (samexpert.com).
Alongside the cuts, GitHub introduced a $0.002 per-minute Actions cloud platform charge that applies to all Actions workflows. For GitHub-hosted runners, that charge is already bundled into the reduced meter price, so it is not a separate line item there (github.com).
