GitHub Actions Adds Runner Deprecation API, Granular Permissions, and Job Introspection

GitHub has shipped three targeted platform enhancements for GitHub Actions focused on runner lifecycle management, token least privilege, and reusable workflow provenance. Platform teams can now query runner lifecycle milestones programmatically via a new REST endpoint (GET /actions/runners/deprecations/{version}) across enterprise, organization, and repository scopes to retrieve exact runtime and registration deprecation timestamps. In parallel, GitHub expanded GITHUB_TOKEN granular permissions with a new vulnerability-alerts scope (supporting read or none), granting automated workflows access to Dependabot data without elevated permissions. Finally, GitHub introduced four new runtime job context properties—job.workflow_ref, job.workflow_sha, job.workflow_repository, and job.workflow_file_path—allowing reusable workflows to inspect their own source definition and commit state rather than only that of the calling workflow. These updates directly tackle the friction between platform maintenance and CI/CD security. Enterprise platform engineers overseeing large fleets of self-hosted runners previously relied on changelog tracking or reactive pipeline failures during brownouts to identify outdated runner agents. Programmatic deprecation tracking allows teams to schedule automated rolling upgrades well ahead of hard cutoffs. Simultaneously, the scoped vulnerability-alerts permission prevents security teams from issuing overly broad personal access tokens or elevated scopes simply to parse Dependabot alerts during build stages. For organizations building reusable workflow catalogs, the new job context variables solve pipeline provenance dilemmas by establishing an unambiguous link to the exact reusable workflow version executed at runtime. This release aligns with GitHub's broader 2026 security and reliability roadmap, which prioritizes deterministic pipeline execution, strict credential scoping, and centralized infrastructure governance. Modern CI/CD systems have increasingly become high-value targets for software supply chain compromises, prompting platform providers to harden the boundary between execution runtimes and privileged metadata. By giving shared modules granular self-reflection capabilities and restricting token blast radiuses, GitHub continues to transform Actions from simple task orchestration into an observable, policy-driven enterprise execution engine. In practice, DevOps teams should incorporate the deprecation endpoint into automated maintenance playbooks or monitoring dashboards to alert on impending runner support windows. Security engineers should audit existing workflows that interact with Dependabot APIs and downgrade permissions to the vulnerability-alerts: read scope, stripping away unnecessary administrative grants. Reusable workflow maintainers should leverage job.workflow_ref and job.workflow_sha to enforce runtime immutability and provenance tracking in compliance automation, noting that these context properties are currently live on GitHub.com and have not yet rolled out to GitHub Enterprise Server.