GitHub Actions Ships Runner Deprecation API, Scoped Security Scopes, and Workflow Identity

GitHub has rolled out three targeted enhancements to GitHub Actions focused on runner lifecycle management, token permission granularity, and reusable workflow introspection. First, a new REST API endpoint (`GET /actions/runners/deprecations/{version}`) provides programmatic access to runtime and registration deprecation dates at the repository, organization, and enterprise levels. Second, GitHub expanded `GITHUB_TOKEN` permissions with a dedicated `vulnerability-alerts` scope (`read` or `none`), allowing workflows to ingest Dependabot alert metadata without elevated privileges. Third, four new job context properties—`job.workflow_ref`, `job.workflow_sha`, `job.workflow_repository`, and `job.workflow_file_path`—enable reusable workflows to inspect their own source location and commit hash at runtime rather than defaulting to top-level caller references. For platform engineers managing hybrid infrastructure and large-scale runner pools, unexpected runner deprecations have historically caused silent pipeline breakage and sudden queue buildup. Exposing machine-readable deprecation milestones allows teams to automate rolling image updates and deprecation alerts before runtime failure occurs. Concurrently, the new `vulnerability-alerts` token scope closes a crucial least-privilege loophole: automated vulnerability reporting previously required broad repository-level tokens or personal access tokens (PATs), needlessly widening attack surfaces during CI runs. Finally, explicit reusable workflow identity gives enterprise platform teams the runtime context required to validate workflow origins, enforce compliance attestation, and decouple shared libraries from caller assumptions. This release aligns directly with the broader industry drive toward software supply chain security and automated CI/CD posture management. As organizations shift security policies left into pull request gates, build pipelines have become high-value targets. Fine-grained credential scoping and verifiable workflow provenance are now core requirements of modern compliance frameworks. By transitioning runner lifecycles from reactive announcements to queryable APIs and narrowing default token scopes, GitHub is systematizing deterministic pipeline governance across the software delivery lifecycle. Practitioners operating self-hosted runner infrastructure should immediately integrate the new deprecation endpoint into automated maintenance pipelines or monitoring alerts to track runtime support sunsets ahead of scheduled cluster updates. Security architects should audit workflows that query Dependabot APIs and downgrade permissions to the least-privilege `vulnerability-alerts: read` permission, deprecating over-permissioned PATs. Platform teams maintaining central reusable workflow repositories should leverage `job.workflow_ref` and `job.workflow_sha` for runtime telemetry and compliance auditing, while keeping in mind that these job context properties currently apply to GitHub.com environments and are not yet available on GitHub Enterprise Server.