GitHub Actions Adds Deprecation APIs and Granular Scopes to Strengthen Pipeline Governance

GitHub has rolled out three governance and security enhancements to GitHub Actions focused on runner lifecycle management, token privilege minimization, and reusable workflow provenance. First, a new REST API endpoint (`GET /actions/runners/deprecations/{version}`) allows administrators to programmatically query both registration and runtime deprecation dates for runner versions across repository, organization, and enterprise scopes. Second, GitHub expanded `GITHUB_TOKEN` permissions with a dedicated `vulnerability-alerts` scope supporting `read` and `none` values, enabling automated pipelines to inspect Dependabot alerts without granting wider repository access. Finally, GitHub introduced four job context properties—`job.workflow_ref`, `job.workflow_sha`, `job.workflow_repository`, and `job.workflow_file_path`—allowing reusable workflows to determine their underlying source identity dynamically at runtime. Why it matters: These additions resolve major operational friction points for platform engineers, central DevOps teams, and security auditors. Teams maintaining large fleets of self-hosted runners or ephemeral scale sets previously lacked a standardized, machine-readable endpoint to track when runner binaries would lose support, creating risks of unexpected build disruptions. On the security front, integrating automated triage or notification workflows for Dependabot previously required overly broad token permissions. The dedicated `vulnerability-alerts` scope directly enforces least-privilege boundaries, while the new job context variables ensure that centralized workflow templates can authenticate their own execution context and commit SHA without ambiguity. Context: This release reflects a continuous industry transition toward zero-trust automation and hardened CI/CD supply chains. As enterprises transition from fragmented pipeline scripts to standardized, centrally maintained reusable workflow catalogs, visibility into template origins and runner lifecycles becomes paramount. Moreover, evolving compliance standards—including SLSA guidelines and enterprise supply chain benchmarks—increasingly mandate strict token isolation and cryptographic provenance tracking across all build steps. What it means in practice: Platform engineers operating self-hosted runner infrastructure should immediately integrate the new deprecation API into their internal monitoring or patching dashboards to proactively schedule runner upgrades before hard cut-offs. Security teams should review workflow files interacting with Dependabot and downgrade token scopes to `vulnerability-alerts: read` to minimize exposure. Lastly, platform teams authoring shared Actions templates should leverage `job.workflow_ref` and `job.workflow_sha` in structured logging and attestation steps to guarantee end-to-end traceability across distributed developer repositories.