GitHub Actions Ships Runner Deprecations API, vulnerability-alerts Permission, Job Context

What shipped

GitHub Actions shipped three updates on September 3, 2026: a new REST API for runner version deprecations, a vulnerability-alerts permission for GITHUB_TOKEN, and four new job context properties for reusable workflows.

What changed

The new endpoint GET /actions/runners/deprecations/{version} works at the repository, organization, or enterprise level and returns runner_version, runtime_deprecates_at, and registration_deprecates_at — so you can plan runner upgrades before a version goes away.

Workflows can now grant GITHUB_TOKEN read-only access to Dependabot alerts via the vulnerability-alerts permission (read or none), following least-privilege instead of broad scopes.

Reusable workflows can identify their own source at runtime with job.workflow_ref, job.workflow_sha, job.workflow_repository, and job.workflow_file_path. For jobs defined directly in a workflow they match github.workflow_ref; they diverge only for reusable workflows. Not available on GitHub Enterprise Server.

Why a builder cares

If you run self-hosted runners or shared reusable workflows, you can now automate upgrade planning instead of chasing deprecation emails, keep Dependabot scanning inside CI with scoped tokens, and build audit logic that knows exactly which workflow file a job came from.