GitHub Actions now includes three updates that give you clearer visibility and finer-grained control over your workflows.

New REST API for runner version deprecations

A new REST API returns when registration and runtime support end for a given runner version, so you can plan runner upgrades before a version is deprecated. Call GET /actions/runners/deprecations/{version} at the repository, organization, or enterprise level. The response includes runner_version, runtime_deprecates_at, and registration_deprecates_at.

New `vulnerability-alerts` permission for `GITHUB_TOKEN`

You can now grant workflows read-only access to Dependabot alerts with the new vulnerability-alerts permission for GITHUB_TOKEN. This permission supports read and none values, which lets you follow least-privilege practices instead of relying on broader scopes. For more information, check the permissions key in the workflow syntax.

New `job` context properties for reusable workflows

Reusable workflows can now determine their own source identity at runtime with four new job context properties:

job.workflow_ref: The full ref of the workflow file that defines the current job.
job.workflow_sha: The commit SHA of the workflow file.
job.workflow_repository: The owner/repo of the workflow file.
job.workflow_file_path: The file path relative to the repository root.

Unlike the existing github.workflow_ref and github.workflow_sha properties, these job context values reflect the workflow that defines the current job. For a job defined directly in a workflow, job.workflow_ref matches github.workflow_ref; they diverge only for reusable workflows. These properties are not available on GitHub Enterprise Server.

To learn more, check the job context documentation.

The post GitHub Actions: Early September 2026 updates appeared first on The GitHub Blog.

New REST API for runner version deprecations

New vulnerability-alerts permission for GITHUB_TOKEN

New job context properties for reusable workflows

New `vulnerability-alerts` permission for `GITHUB_TOKEN`

New `job` context properties for reusable workflows

Related articles