mcpField
G
github-actions-runtime-upgrade-conventions

github-actions-runtime-upgrade-conventions

github.com/githubCloud & DevOps40.5k198 installsUpdated today
Repository

About github-actions-runtime-upgrade-conventions

github-actions-runtime-upgrade-conventions is a skill for developers updating GitHub Actions workflows in response to runtime deprecation warnings. It emphasizes compatible major-version upgrades, immutable SHA pins, and behavior-preserving validation.

Key features

  1. 01Upgrade compatible action major versions
  2. 02Pin actions to full commit SHAs
  3. 03Change one action per commit
  4. 04Preserve workflow behavior
  5. 05Validate workflows and run logs

Use cases

  1. 01Responding to deprecated runtime warnings
  2. 02Updating actions in workflow YAML files
  3. 03Reviewing runtime-sensitive setup actions
  4. 04Preparing and validating an upgrade pull request

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/github/awesome-copilot --skill github-actions-runtime-upgrade-conventions

After installing, type/github-actions-runtime-upgrade-conventionsin Claude Code to confirm it loaded.

Details

From the project README

GitHub Actions Runtime Upgrade Conventions

Use this skill when editing GitHub Actions workflows to address deprecation warnings about action runtimes (for example Node.js runtime migrations).

Use This Skill When

  • Workflow logs report an action is running on a deprecated runtime.
  • You are upgrading action versions in .github/workflows/*.yml or .github/workflows/*.yaml.
  • You need to keep existing workflow behavior while modernizing action dependencies.

Upgrade Rules

  • Prefer upgrading to the latest stable major version of each action that is compatible with the workflow.
  • Prefer immutable pins: resolve the target release to a full commit SHA and use that SHA in uses:.
  • Do not pin to mutable tags or branches (for example @v4 or @main) in final recommendations.
  • Upgrade one action at a time per commit (or one tightly related group) so failures are easy to isolate.
  • Keep existing workflow behavior unchanged while upgrading runtime/dependency actions.

Actions We Track in This Repo

Prioritize runtime review for these groups when warnings appear:

  • Any first-party action under actions/*
  • Especially setup actions under actions/setup-* (for example setup-node, setup-python, setup-dotnet)
  • Any other action explicitly named by the runtime deprecation warning in workflow logs

Pinning Pattern

steps:
  - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.3.1
  - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.4

When recommending upgrades, identify the latest compatible release first, then use the corresponding commit SHA with an optional version comment.

Verification Checklist

After changing action versions:

  1. Ensure all edited workflows still parse and keep the same triggers/permissions unless intentionally changed.
  2. Run the affected workflows (or equivalent local build/test commands) and confirm the upgraded steps complete successfully.
  3. Confirm release/signing/artifact steps still produce expected outputs where applicable.
  4. Check workflow run logs for any new deprecation warnings or runtime migration notes.

PR Notes

Include in the PR summary:

  • Which actions were upgraded (from -> to).
  • Whether any action could not move to a new major and why.
  • Which workflows were re-run to validate the change.

How This Complements Dependabot

Dependabot can automate many updates, but this skill still helps when:

  • Dependabot is not enabled for workflows in a repository.
  • Runtime warnings appear before an automated update is available.
  • A workflow needs behavior-preserving validation after the action bump.

Comments

Markdown supported