GitHub Actions September 2026 Changelog: Three Targeted Updates
On 3 September 2026, GitHub published its early September 2026 Actions changelog, shipping three specific improvements to workflow control and observability: a REST API for programmatic runner version deprecation tracking, a new vulnerability-alerts permission for GITHUB_TOKEN, and new job context properties that let reusable workflows verify their own source identity at runtime. Each of the three addresses a concrete operational gap that engineering teams managing CI/CD pipelines at scale have worked around with less precise tooling.
Runner Version Deprecation REST API
The first and most operationally significant update is a new REST API endpoint for querying the deprecation timeline of any GitHub Actions runner version. Teams can now call GET /actions/runners/deprecations/{version} at the repository, organisation, or enterprise level. The response includes three fields: runner_version, runtime_deprecates_at, and registration_deprecates_at.
runtime_deprecates_at is the date after which workflows running on that runner version will fail at runtime. registration_deprecates_at is the date after which new self-hosted runner registrations for that version will be rejected. Before this API, teams learned about runner deprecations through changelog announcements or by waiting for warning messages in workflow logs — both reactive. There was no programmatic method to query when a specific runner version would stop functioning.
Self-Hosted Runner Operations
For teams managing fleets of self-hosted runners — common at organisations that need to run CI workloads on private infrastructure, specific hardware, or inside private networks — the runner deprecation API provides the information needed to schedule version upgrades proactively. Platform teams can build internal dashboards or automated alerts that surface upcoming deprecation dates for every runner version in their fleet, without relying on calendar reminders or changelog monitoring.
Dependabot Vulnerability-Alerts Permission
The second update adds a vulnerability-alerts permission to GITHUB_TOKEN inside GitHub Actions workflows. Previously, workflows that needed to read Dependabot alert data were forced to rely on broader token scopes or external personal access tokens, both of which grant more permissions than reading alerts alone requires. The new permission accepts two values: read and none.
A workflow granted vulnerability-alerts: read can retrieve Dependabot alert information for reporting, gating, or export purposes without receiving elevated access to other repository resources. This enables least-privilege token design at the CI layer: the workflow gets exactly the access it needs, no more. The practical use cases include workflows that block deployments when Dependabot has flagged critical unresolved vulnerabilities, workflows that export security status to external dashboards, and compliance automation that records dependency vulnerability state at each release.
Reusable Workflow Source Identity
The third update adds four new job context properties that allow reusable workflows to determine their own source identity at runtime. The primary new property is job.workflow_ref, which returns the full Git ref of the workflow file defining the current job.
When a reusable workflow is invoked from multiple repositories, multiple branches, or multiple organisations, job.workflow_ref lets the workflow's own logic verify where it was loaded from. A centralised deployment workflow maintained by a platform team can use job.workflow_ref to enforce that certain deployment steps execute only when called from a specific branch — without relying on the calling workflow to pass its own identity as an input parameter.
What This Means for Development Teams in India
The September 2026 GitHub Actions updates address three points where current CI/CD tooling is imprecise or reactive. For Indian engineering platform teams managing large self-hosted runner fleets, the runner deprecation API converts an unscheduled disruption risk into a manageable, planned maintenance event. The API makes it possible to query deprecation windows automatically and incorporate them into standard infrastructure rotation schedules.
The Dependabot vulnerability-alerts permission is directly relevant for teams incorporating dependency vulnerability state into their release gates. As India's software compliance landscape evolves — with RBI security guidelines applicable to fintech operators and DPDP Act obligations adding data-handling accountability requirements — the ability to enforce vulnerability status checks at CI time with minimal token scope becomes both a technical best practice and a governance requirement.
The reusable workflow source identity properties benefit any engineering organisation that maintains shared workflow libraries used by multiple internal teams. In India's larger product companies and IT services firms, where platform teams frequently maintain shared CI/CD templates consumed by dozens of product squads, the ability to enforce call-context policy inside a centralised workflow reduces the surface area for misconfiguration and supply-chain risk in the CI layer.
The Bottom Line
GitHub published its early September 2026 Actions changelog on 3 September 2026, introducing three specific improvements. The runner deprecation REST API — GET /actions/runners/deprecations/{version} — lets teams programmatically retrieve runtime_deprecates_at and registration_deprecates_at for any runner version before it stops functioning. The new vulnerability-alerts GITHUB_TOKEN permission (values: read and none) enables least-privilege read access to Dependabot alert data in workflows without broader token scopes. Four new job context properties, led by job.workflow_ref, give reusable workflows the ability to verify their own source identity at runtime. All three updates are available immediately on GitHub.com.
Frequently Asked Questions
What are the three changes in the GitHub Actions September 2026 changelog?+
The GitHub Actions early September 2026 changelog, published 3 September 2026, introduces three updates. First, a new REST API endpoint — GET /actions/runners/deprecations/{version} — lets teams query when a specific runner version will stop accepting registrations and stop functioning at runtime, returning runner_version, runtime_deprecates_at, and registration_deprecates_at. Second, a new vulnerability-alerts permission for GITHUB_TOKEN enables workflows to read Dependabot alert data with read or none access, replacing the need for broader token scopes or personal access tokens. Third, four new job context properties — led by job.workflow_ref — allow reusable workflows to determine their own source identity at runtime.
How does the runner deprecation REST API work in GitHub Actions?+
The runner deprecation REST API is available at GET /actions/runners/deprecations/{version} and can be called at the repository, organisation, or enterprise level. The version path parameter accepts any runner version string. The response includes three fields: runner_version (the version queried), runtime_deprecates_at (the date after which workflows on this runner version will fail), and registration_deprecates_at (the date after which new self-hosted runners registering on this version will be rejected). Before this API, engineering teams managing self-hosted runner fleets had no programmatic way to query deprecation timelines and instead relied on reading GitHub changelogs or watching for in-workflow warnings. The API enables automated alerting and planned migration scheduling before a deprecation date disrupts production workflows.
What is the vulnerability-alerts GITHUB_TOKEN permission and why does it matter?+
The vulnerability-alerts permission is a new addition to the GITHUB_TOKEN permission model in GitHub Actions, added in the September 2026 changelog. It accepts two values: read grants the workflow access to Dependabot alert information for the repository; none explicitly revokes that access. Before this permission existed, workflows that needed Dependabot alert data relied on broader token scopes or personal access tokens with permissions beyond what reading alerts requires. The new permission enables precise least-privilege token design: a workflow that needs to check for unresolved critical vulnerabilities before a deployment receives exactly that access and nothing more, reducing the blast radius of a compromised workflow token.
What does job.workflow_ref do in GitHub Actions reusable workflows?+
job.workflow_ref is a new job context property added in the GitHub Actions September 2026 changelog. It returns the full Git ref of the workflow file that defines the current job, allowing a reusable workflow to determine its own source at runtime. When a shared workflow library is called from multiple repositories, branches, or organisations, job.workflow_ref lets the shared workflow's own logic verify where it was invoked from. A platform team maintaining a centralised deployment workflow can use job.workflow_ref to enforce that certain deployment steps execute only when called from a specific branch — for example, the organisation's release branch — without requiring the calling workflow to pass its own identity as an input parameter. Three additional new job context properties accompany job.workflow_ref in the same update.
Written by
TechPillow Team
Sharing insights on technology, product development, and the Indian tech ecosystem.
