v1.9.0

What's changed

• Support background, wait, wait-all, cancel, and parallel steps, including validation of background-step references and invalid nested parallel steps. (rhysd#695, thanks @devantler)
• Support the code-quality and vulnerability-alerts permission scopes with their GitHub-supported access levels, and accept the models and repository-projects permission names. (rhysd#674, thanks @smlx; rhysd#714, thanks @kalverra)
• Support $/path self-repository references for actions and reusable workflows, including local metadata, input, and output validation. (rhysd#711)
• Support job.workflow_file_path, job.workflow_ref, job.workflow_repository, job.workflow_sha, and jobs.<job_id>.result in expressions. (rhysd#696, thanks @nikolauspschuetz; rhysd#707, thanks @l46983284-cpu; rhysd#724, thanks @Eljees)
• Avoid false errors for repository secrets in reusable workflows that also define another trigger. (rhysd#701, rhysd#703, thanks @Eljees)
• Support the destroyed activity type for the merge_group event and refresh the generated webhook activity types. (rhysd#726)
• Update the popular actions data set with current major releases, including actions/checkout@v7, actions/cache@v6, actions/setup-go@v7, and codecov/codecov-action@v7. (Based on rhysd#718, thanks @kolyshkin)

Full Changelog: v1.8.0...v1.9.0