Skills

Skill 190 of 200

GitHub Actions Runtime Upgrade Conventions

Upgrade GitHub Actions to supported runtimes by selecting safe action versions, preserving workflow behavior, and validating post-upgrade execution.

2 minutes · 342 words · 7 sections

Install

$ npx skills add github/awesome-copilot --skill github-actions-runtime-upgrade-conventions

$ npx skills add github/awesome-copilot

» /plugin marketplace add github/awesome-copilot

The first command installs just this skill, by the name in its SKILL.md; the second installs the whole repository.

Use this skill when editing GitHub Actions workflows to address deprecation warnings about action runtimes (for example Node.js runtime migrations).

Use This Skill When

Workflow logs report an action is running on a deprecated runtime.
You are upgrading action versions in .github/workflows/*.yml or .github/workflows/*.yaml.
You need to keep existing workflow behavior while modernizing action dependencies.

Upgrade Rules

Prefer upgrading to the latest stable major version of each action that is compatible with the workflow.
Prefer immutable pins: resolve the target release to a full commit SHA and use that SHA in uses:.
Do not pin to mutable tags or branches (for example @v4 or @main) in final recommendations.
Upgrade one action at a time per commit (or one tightly related group) so failures are easy to isolate.
Keep existing workflow behavior unchanged while upgrading runtime/dependency actions.

Actions We Track in This Repo

Prioritize runtime review for these groups when warnings appear:

Any first-party action under actions/*
Especially setup actions under actions/setup-* (for example setup-node, setup-python, setup-dotnet)
Any other action explicitly named by the runtime deprecation warning in workflow logs

Pinning Pattern

steps:
  - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.3.1
  - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.4

When recommending upgrades, identify the latest compatible release first, then use the corresponding commit SHA with an optional version comment.

Verification Checklist

After changing action versions:

Ensure all edited workflows still parse and keep the same triggers/permissions unless intentionally changed.
Run the affected workflows (or equivalent local build/test commands) and confirm the upgraded steps complete successfully.
Confirm release/signing/artifact steps still produce expected outputs where applicable.
Check workflow run logs for any new deprecation warnings or runtime migration notes.

PR Notes

Include in the PR summary:

Which actions were upgraded (from -> to).
Whether any action could not move to a new major and why.
Which workflows were re-run to validate the change.

How This Complements Dependabot

Dependabot can automate many updates, but this skill still helps when:

Dependabot is not enabled for workflows in a repository.
Runtime warnings appear before an automated update is available.
A workflow needs behavior-preserving validation after the action bump.

Colophon for this issue

Colophon

How this issue was made

Source

github.com/github/awesome-copilot, branch main, last pushed 24 September 2026.

Licence

MIT — the text of every skill is reproduced unmodified, frontmatter included, under the upstream licence.

Discovery

200 skills found by walking the repository tree for SKILL.md, not by matching a directory convention. 2 distinct layouts observed: .github/skills/*/SKILL.md, skills/*/SKILL.md.

Authorship

3 of 200 skills are installed into the repository rather than published from it. They are shelved in the closing “Credited skills” part and remain the work of their own authors. A skill counts as credited when its only copy lives under one agent’s dot directory; visible directories, per-agent mirror sets, and skills installable from this repository on skills.sh all count as published.

Issue colours

Resolved from a curated brand profile — hue 295°, chroma 0.190. Two accent tones are generated per issue and each is proven against its own ground before it ships: a single accent that passes AA on both light and dark paper is arithmetically impossible.

Heading repairs

1 repair applied to this skill so the document has one h1 and no skipped levels:

Removed “GitHub Actions Runtime Upgrade Conventions”, a leading h1 that duplicated the skill title.

Spec compliance

Every skill satisfies the Agent Skills specification’s frontmatter rules.

Images

Images inside a skill come from the upstream repository. Where the author gave no alternative text we mark the image decorative rather than inventing a description — a plausible caption we made up is worse than none for the reader who depends on it.

Marketplace

A plugin manifest is published at .github/plugin/marketplace.json by GitHub, declaring 162 plugins. It is read for editorial metadata only — never as the skill index, which is always the repository tree.

Signal

Install counts come from skills.sh. They measure downloads, not quality, and an unranked repository is not an unread one.

Agent surfaces

The whole issue is available as one markdown document at /github/awesome-copilot.md, and each skill at its own .md URL.

Publication

Set by Skills Docs from the source repository. Body text is Literata at the reader’s chosen size and measure; code is Geist Mono. Nothing on this page was written by us except this paragraph.

Use this skill when editing GitHub Actions workflows to address deprecation warnings about action runtimes (for example Node.js runtime migrations).

Use This Skill When

Workflow logs report an action is running on a deprecated runtime.
You are upgrading action versions in .github/workflows/*.yml or .github/workflows/*.yaml.
You need to keep existing workflow behavior while modernizing action dependencies.

Upgrade Rules

Prefer upgrading to the latest stable major version of each action that is compatible with the workflow.
Prefer immutable pins: resolve the target release to a full commit SHA and use that SHA in uses:.
Do not pin to mutable tags or branches (for example @v4 or @main) in final recommendations.
Upgrade one action at a time per commit (or one tightly related group) so failures are easy to isolate.
Keep existing workflow behavior unchanged while upgrading runtime/dependency actions.

Actions We Track in This Repo

Prioritize runtime review for these groups when warnings appear:

Any first-party action under actions/*
Especially setup actions under actions/setup-* (for example setup-node, setup-python, setup-dotnet)
Any other action explicitly named by the runtime deprecation warning in workflow logs

Pinning Pattern

steps:
  - uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.3.1
  - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.4

When recommending upgrades, identify the latest compatible release first, then use the corresponding commit SHA with an optional version comment.

Verification Checklist

After changing action versions:

Ensure all edited workflows still parse and keep the same triggers/permissions unless intentionally changed.
Run the affected workflows (or equivalent local build/test commands) and confirm the upgraded steps complete successfully.
Confirm release/signing/artifact steps still produce expected outputs where applicable.
Check workflow run logs for any new deprecation warnings or runtime migration notes.

PR Notes

Include in the PR summary:

Which actions were upgraded (from -> to).
Whether any action could not move to a new major and why.
Which workflows were re-run to validate the change.

How This Complements Dependabot

Dependabot can automate many updates, but this skill still helps when:

Dependabot is not enabled for workflows in a repository.
Runtime warnings appear before an automated update is available.
A workflow needs behavior-preserving validation after the action bump.