{"slug": "github-actions-september-2026-three-pipeline-fixes", "title": "GitHub Actions September 2026: Three Pipeline Fixes", "summary": "GitHub shipped three Actions changes on September 3, 2026: a runner deprecation REST API, a new `vulnerability-alerts` permission for `GITHUB_TOKEN` that grants read-only Dependabot alert access without a stored Personal Access Token, and four new `job` context properties (`job.workflow_ref`, `job.workflow_sha`, `job.workflow_repository`, `job.workflow_file_path`) that let reusable workflows identify their own source repository, commit SHA, and file path. The new `vulnerability-alerts` permission supports `read` and `none`, and the `job` context properties are available only on GitHub.com, not GitHub Enterprise Server in this release.", "body_md": "On September 3, GitHub shipped three changes to Actions that most developers missed while watching the AI release cycle. No new model, no Copilot integration, no viral tweet. What shipped was a runner deprecation REST API, a new `GITHUB_TOKEN` permission for Dependabot alerts, and four new `job` context properties for reusable workflows. Each one closes a gap that has been making pipelines brittle or forcing ugly credential workarounds for years. Worth fifteen minutes of your attention.\n\n## Kill the PAT: vulnerability-alerts Permission Is Here\n\nReading Dependabot alerts from a workflow has always required a stored Personal Access Token with `security_events` scope — a broad, long-lived credential sitting in your repo secrets, rotated manually, and quietly accumulating scope-creep across the org. The new `vulnerability-alerts` permission for `GITHUB_TOKEN` eliminates all of that.\n\nAdd two lines to your workflow and you have read-only Dependabot alert access — no PAT required:\n\n```\npermissions:\n  contents: read\n  vulnerability-alerts: read\n```\n\nThe permission supports `read` and `none`. Here is a minimal security gate that blocks deployment when critical Dependabot alerts are open:\n\n```\nname: Security Gate\non: [push]\npermissions:\n  vulnerability-alerts: read\njobs:\n  check-alerts:\n    runs-on: ubuntu-latest\n    steps:\n      - name: Block on critical Dependabot alerts\n        run: |\n          ALERTS=$(gh api /repos/${{ github.repository }}/dependabot/alerts \\\n            --jq '[.[] | select(.state==\"open\" and .security_advisory.severity==\"critical\")] | length')\n          if [ \"$ALERTS\" -gt \"0\" ]; then\n            echo \"$ALERTS critical alerts open. Fix before deploy.\"\n            exit 1\n          fi\n```\n\nThis should have been possible two years ago. Every team that wanted automated Dependabot gates without PAT sprawl was stuck. Now it is not. If your security posture relies on a stored `security_events` PAT today, replacing it with this permission is the first thing to do this week. The [GitHub secure use reference](https://docs.github.com/en/actions/reference/security/secure-use) documents the full permissions model.\n\n## Reusable Workflows Can Finally Identify Themselves\n\nReusable workflows are how large engineering orgs share CI/CD logic across dozens of repositories. Their persistent problem was self-identification: a reusable workflow had no reliable way to know its own source repository, commit SHA, or file path at runtime. `github.workflow_ref` points to the *caller’s* workflow, not the callee’s, which means audit logs attributed CI runs to the wrong place.\n\nSeptember 3 fixed this with four new `job` context properties available when a workflow is invoked as a reusable workflow:\n\n- `job.workflow_ref` — full ref of the workflow file that defines the current job\n- `job.workflow_sha` — commit SHA of the workflow file\n- `job.workflow_repository` —`owner/repo` of the workflow file\n- `job.workflow_file_path` — file path relative to the repository root\n\nThe key behavior: for a regular workflow job, `job.workflow_ref` and `github.workflow_ref` match. For a called reusable workflow, they diverge — `job.workflow_ref` identifies the callee, `github.workflow_ref` still identifies the caller. That divergence is the whole point. Your shared deploy workflow can now log its own source identity without being passed explicit inputs:\n\n```\n# org/.github/workflows/shared-deploy.yml\njobs:\n  deploy:\n    runs-on: ubuntu-latest\n    steps:\n      - name: Audit log\n        run: |\n          echo \"Workflow: ${{ job.workflow_ref }}\"\n          echo \"SHA: ${{ job.workflow_sha }}\"\n          echo \"Repo: ${{ job.workflow_repository }}\"\n```\n\nOne limitation: these properties are only available on GitHub.com. GitHub Enterprise Server does not get them in this release. Check the [contexts reference](https://docs.github.com/en/actions/reference/workflows-and-actions/contexts) for the complete job context schema.\n\n## The Runner Deprecation API — Right Before the September 25 Deadline\n\nGitHub is enforcing a minimum self-hosted runner version (2.329.0) starting September 25 for GitHub Enterprise Cloud. If you manage many self-hosted runners and want to know which versions will stop receiving jobs before they actually stop, there is now a REST API for that.\n\nThe endpoint is available at repository, organization, and enterprise scope:\n\n```\nGET https://api.github.com/orgs/YOUR_ORG/actions/runners/deprecations/2.300.0\n```\n\nThe response includes `runner_version`, `runtime_deprecates_at`, and `registration_deprecates_at`. Write a script that loops your runner versions, hits this endpoint for each, and fires a Slack alert when `runtime_deprecates_at` is within 30 days. Your ops team knows before pipelines go dark, not after. For the enforcement deadline itself, see [GitHub Actions Self-Hosted Runners: Fix Before September 25](https://byteiota.com/github-actions-runner-enforcement-september-2026/).\n\n## What to Do This Week\n\n1. **Replace any `security_events` PATs in CI** with`vulnerability-alerts: read` on`GITHUB_TOKEN` . Audit your repo secrets — PATs with this scope are now unnecessary and should be revoked.\n2. **Add `job.workflow_ref` logging to your reusable workflows** if you share CI logic across repos. Immediate audit traceability with zero infrastructure cost.\n3. **Query the runner deprecation API against your fleet** before September 25. Any runner version with a past`runtime_deprecates_at` needs an upgrade now. Review your[Actions cache configuration](https://byteiota.com/github-actions-cache-mode-lock-down-your-ci-cache/) while you are in the runner settings.\n\nAll three changes are live for all GitHub.com users now. The full changelog is on the [GitHub Blog](https://github.blog/changelog/2026-09-03-github-actions-early-september-2026-updates/). GitHub’s broader security direction for Actions is documented in the [2026 security roadmap](https://github.blog/news-insights/product-news/whats-coming-to-our-github-actions-2026-security-roadmap/) — these three updates are direct items from it.", "url": "https://wpnews.pro/news/github-actions-september-2026-three-pipeline-fixes", "canonical_source": "https://byteiota.com/github-actions-september-2026-pipeline-fixes/", "published_at": "2026-09-18 17:10:31+00:00", "updated_at": "2026-09-18 17:23:39.922936+00:00", "lang": "en", "topics": ["developer-tools", "ai-tools"], "entities": ["GitHub", "GitHub Actions", "GITHUB_TOKEN", "Dependabot", "GitHub Enterprise Server", "Copilot"], "alternates": {"html": "https://wpnews.pro/news/github-actions-september-2026-three-pipeline-fixes", "markdown": "https://wpnews.pro/news/github-actions-september-2026-three-pipeline-fixes.md", "text": "https://wpnews.pro/news/github-actions-september-2026-three-pipeline-fixes.txt", "jsonld": "https://wpnews.pro/news/github-actions-september-2026-three-pipeline-fixes.jsonld"}}