GitHub Actions: Early September 2026 updates
GitHub Actions now includes three updates that give you clearer visibility and finer-grained control over your workflows.
GitHub Actions picked up three changes today, covering runner lifecycle visibility, token scoping, and reusable workflow identity.
- A new REST API returns when a given runner version's registration and runtime support end, so teams can plan upgrades ahead of deprecation. It can be called at the repository, organization, or enterprise level and returns the runner version along with its runtime and registration deprecation dates.
- A new vulnerability-alerts permission for GITHUB_TOKEN grants workflows read-only access to Dependabot alerts, supporting read and none values so workflows no longer need broader scopes just to read alerts.
- Reusable workflows can now read four new job context properties, workflow_ref, workflow_sha, workflow_repository, and workflow_file_path, which identify the workflow file that defines the current job. These differ from the existing github.workflow_ref and github.workflow_sha, which point to the caller, only when a reusable workflow is involved. They are not available on GitHub Enterprise Server.
Full details are in the changelog post.
GitHub
Where the world builds software — Git hosting, pull requests, issues, Actions CI/CD, and Copilot, free for public and private repos.
View GitHub →