GitHub Actions Adds Deprecation APIs and Granular Scopes for Reusable CI Workflows

GitHub has rolled out three targeted enhancements to GitHub Actions designed to improve runner governance, pipeline security, and modular workflow visibility. The first update introduces a dedicated REST API endpoint (GET /actions/runners/deprecations/{version}) available at the repository, organization, and enterprise levels, returning precise registration and runtime end-of-life dates for runner releases. The second adds a granular vulnerability-alerts permission (supporting read and none values) to GITHUB_TOKEN, enabling workflows to inspect Dependabot alerts without broad repository permissions. Finally, GitHub introduced four new job context properties—job.workflow_ref, job.workflow_sha, job.workflow_repository, and job.workflow_file_path—allowing reusable workflows to resolve their own runtime source identity separately from the calling workflow. These capabilities address persistent friction points in enterprise CI/CD administration. Platform engineering teams maintaining large runner fleets frequently struggle with unexpected build failures caused by silent runner runtime deprecations. The new API transforms runner maintenance from a manual documentation review into an automatable lifecycle check. Concurrently, granting least-privilege access to Dependabot alerts closes a common security gap where teams previously escalated workflow permissions simply to generate automated vulnerability reports. Surfacing job-level workflow metadata also solves identity ambiguity when auditing complex, nested pipeline execution trees. This release aligns with the broader industry drive toward supply chain integrity, least privilege, and platform engineering self-service. As organizations consolidate CI/CD pipelines into centralized template libraries, runtime provenance and least-privilege scopes have become mandatory for regulatory compliance and software supply chain security standards like SLSA. By providing discrete context variables for reusable templates and specialized token scopes, GitHub Actions is maturing from a developer automation tool into a more strictly governed enterprise delivery engine. In practice, DevOps practitioners should immediately review their workflow configurations to replace overscoped administrative permissions with vulnerability-alerts: read in reporting pipelines. Platform teams managing self-hosted or ephemeral runner pools should build proactive monitoring jobs around the deprecations endpoint to trigger automated alerts ahead of scheduled version phaseouts. Finally, teams leveraging reusable workflows should integrate the new job context variables into their build logs and security audit trails to guarantee complete traceability of executing templates.