GitHub Actions Adds Reusable Workflow Context, Scoped Alert Tokens, and Runner Deprecation APIs

GitHub has rolled out three structural updates to GitHub Actions designed to provide engineering teams with granular visibility and stricter least-privilege controls across automated pipelines. The first addition is a dedicated REST endpoint—GET /actions/runners/deprecations/{version}—accessible at repository, organization, and enterprise levels to return exact end-of-life dates for runner registration and runtime support. Second, GitHub added a dedicated vulnerability-alerts permission to GITHUB_TOKEN, allowing workflows to request read-only access to Dependabot security alerts without broad repository permissions. Third, reusable workflows receive four new job context properties (job.workflow_ref, job.workflow_sha, job.workflow_repository, and job.workflow_file_path) that identify the callee workflow's source identity at runtime. These updates address long-standing operational pain points for enterprise platform administrators and security engineers. Historically, maintaining shared, centralized workflow repositories was hindered because context variables like github.workflow_ref resolved to the caller repository rather than the reusable workflow itself. Developers often had to resort to hacky workarounds or OIDC token parsing to let shared workflows fetch their own auxiliary scripts and configuration files. With dedicated job context properties, reusable workflows can deterministically fetch internal assets from their own immutable commit SHAs. Concurrently, the vulnerability-alerts permission closes an important security gap by eliminating the need for elevated repository-wide tokens merely to inspect Dependabot findings in automated compliance jobs. This release aligns directly with the broader DevOps trend toward supply chain hardening and platform engineering standardization. As enterprise development organizations consolidate fragmented pipelines into centralized, auditable workflow templates, CI/CD systems must treat workflow modules and runner fleets as deterministic, observable infrastructure. Conflating caller metadata with library metadata compromised boundary enforcement in complex multi-repo architectures. Similarly, unannounced runner deprecations have routinely caused sudden pipeline failures in large runner fleets. Exposing deprecation schedules programmatically reflects an industry-wide transition toward proactive CI/CD infrastructure lifecycle management. In practice, engineering leads should immediately update automated audit scripts to leverage the new runner deprecation API, integrating deprecation checks into continuous deployment pipelines for self-hosted and custom runner images. Security and DevOps teams should review workflow files that ingest Dependabot data and downgrade workflow permissions from wide scopes down to vulnerability-alerts: read. Finally, maintainers of shared CI/CD libraries should refactor scripts to consume job.workflow_repository and job.workflow_sha, ensuring that child workflows execute cleanly against their own pinned revisions without polluting caller repository configurations.