GitHub Actions 2026年9月更新：Runner弃用API、权限收紧与新上下文
GitHub Actions: Early September 2026 updates
GITHUB_TOKEN 权限收紧是破坏性变更，必须检查 workflow 配置；Runner 弃用 API 对运维至关重要。建议立即审查权限并适配新上下文。
GitHub Actions now includes three updates that give you clearer visibility and finer-grained control over your workflows.
GitHub Actions 现在包含三项更新，使您能够更清晰地了解工作流状态，并对工作流进行更细粒度的控制。
New REST API for runner version deprecations
用于运行程序版本弃用的新 REST API
A new REST API returns when registration and runtime support end for a given runner version, so you can plan runner upgrades before a version is deprecated. Call GET /actions/runners/deprecations/{version} at the repository, organization, or enterprise level. The response includes runner_version, runtime_deprecates_at, and registration_deprecates_at.
新的 REST API 可返回给定运行程序版本的注册和运行时支持结束时间，以便您在版本被弃用之前规划运行程序升级。在仓库、组织或企业级别调用 GET /actions/runners/deprecations/{version}。响应中包含 runner_version、runtime_deprecates_at 和 registration_deprecates_at。
New vulnerability-alerts permission for GITHUB_TOKEN
GITHUB_TOKEN 的新 vulnerability-alerts 权限
You can now grant workflows read-only access to Dependabot alerts with the new vulnerability-alerts permission for GITHUB_TOKEN. This permission supports read and none values, which lets you follow least-privilege practices instead of relying on broader scopes. For more information, check the permissions key in the workflow syntax.
您现在可以通过为 GITHUB_TOKEN 添加新的 vulnerability-alerts 权限，授予工作流对 Dependabot 告警的只读访问权限。此权限支持 read 和 none 值，使您能够遵循最小权限原则，而不是依赖更广泛的范围。有关更多信息，请检查工作流语法中的 permissions 键。
New job context properties for reusable workflows
可重用工作流的新 job 上下文属性
Reusable workflows can now determine their own source identity at runtime with four new job context properties:
可重用工作流现在可以使用四个新的 job 上下文属性在运行时确定其自身的源身份：
- job.workflow_ref: The full ref of the workflow file that defines the current job.
- job.workflow_sha: The commit SHA of the workflow file.
- job.workflow_repository: The owner/repo of the workflow file.
- job.workflow_file_path: The file path relative to the repository root.
- job.workflow_ref：定义当前作业的 workflow 文件的完整 ref。
- job.workflow_sha：workflow 文件的提交 SHA。
- job.workflow_repository：workflow 文件的 owner/repo。
- job.workflow_file_path：相对于仓库根目录的文件路径。
Unlike the existing github.workflow_ref and github.workflow_sha properties, these job context values reflect the workflow that defines the current job. For a job defined directly in a workflow, job.workflow_ref matches github.workflow_ref; they diverge only for reusable workflows. These properties are not available on GitHub Enterprise Server.
与现有的 github.workflow_ref 和 github.workflow_sha 属性不同，这些 job 上下文值反映的是定义当前作业的工作流。对于直接在 workflow 中定义的作业，job.workflow_ref 与 github.workflow_ref 匹配；它们仅在可重用工作流中才会出现差异。这些属性在 GitHub Enterprise Server 上不可用。
To learn more, check the job context documentation.
要了解更多信息，请参阅 job 上下文文档。
The post GitHub Actions: Early September 2026 updates appeared first on The GitHub Blog.
《GitHub Actions：2026 年 9 月初更新》一文首发于 The GitHub Blog。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力