GitHub Actions Adds New API, Permissions, and Workflow Context Properties
GitHub Actions now includes three updates that provide clearer visibility and finer-grained control over CI/CD workflows. A new REST API helps users plan runner upgrades by exposing deprecation dates for runner versions. Workflows can also leverage a dedicated `vulnerability-alerts` permission for `GITHUB_TOKEN` to gain read-only access to Dependabot alerts with a least-privilege approach. Additionally, reusable workflows can now determine their own source identity at runtime using four new job context properties, though these are not available on GitHub Enterprise Server.
- →REST API for Runner Version Deprecations
- →Vulnerability Alerts Permission for GITHUB_TOKEN
- →Job Context Properties for Reusable Workflows
Features (3) ›
- REST API for Runner Version Deprecations
A new REST API allows users to query end-of-support dates for specific runner versions. This enables proactive planning and upgrading of runners before their registration and runtime support are deprecated.
- Vulnerability Alerts Permission for GITHUB_TOKEN
Workflows can now be granted read-only access to Dependabot alerts using the new `vulnerability-alerts` permission for the `GITHUB_TOKEN`. This feature supports least-privilege security practices by providing a specific scope for alert access.
- Job Context Properties for Reusable Workflows
Four new `job` context properties (`workflow_ref`, `workflow_sha`, `workflow_repository`, `workflow_file_path`) are now available for reusable workflows. These properties allow reusable workflows to determine their own source identity at runtime, distinguishing them from the `github` context for jobs defined directly in a workflow, though they are not supported on GitHub Enterprise Server.
https://github.blog/changelog/2026-09-03-github-actions-early-september-2026-updates
Related releases
- npm adds multiple trusted publishing configurations, improves security for staged releases GitHub Changelog ·
- GitHub CLI Linux package signing key expires September 5, 2026 GitHub Changelog ·
- GitHub Copilot to Deprecate Selected AI Models by October 2026 GitHub Changelog ·
- Gemini 3.8 Flash Now Available in GitHub Copilot GitHub Changelog ·
- GitHub Reopens Copilot Business & Enterprise Sign-ups with Billing Updates GitHub Changelog ·
- CodeQL 2.26.4 Enhances GitHub Actions Security Detections and Language Support GitHub Changelog ·