GitHub Actions Deprecation Lint: the 2026 runner and action EOL dates

Five lines in this release workflow stop running on dates GitHub has already published - for the platform engineers who own .github/workflows, the first of them lands on 2026-09-23. Here is the audit of that file, exactly as it prints:

.github/workflows/release.yml
   7  error  the ubuntu-20.04 runner image became fully unsupported on 2025-04-15 - the job fails to start. Use ubuntu-24.04.
   9  warn   actions/checkout@v1-v4 runs on Node 20. Node 20 is removed from GitHub-hosted runners on 2026-09-23 - move to actions/checkout@v5 (needs runner 2.327.1 or later).
  11  error  the ::set-output workflow command was disabled on 2023-06-01 and is now ignored - write to the $GITHUB_OUTPUT file instead.
  12  error  artifact actions v3 were shut down on 2025-01-30 - the step fails today. Move to v6 (v4 changed to immutable artifacts, so a job that uploaded the same name twice needs merge-multiple).
  15  warn   ubuntu-22.04 and ubuntu-22.04-arm enter deprecation on 2026-09-17 and are fully unsupported on 2027-04-17 - move to ubuntu-24.04 or ubuntu-26.04 before the brownouts start.

Three of those five are already fatal. The file they came from:

name: release
on:
  push:
    tags: ['v*']
jobs:
  build:
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm run build
      - run: echo "::set-output name=version::1.4.0"
      - uses: actions/upload-artifact@v3
        with: { name: dist, path: dist }
  smoke:
    runs-on: ubuntu-22.04
    steps:
      - run: npm test

Nothing in it looks wrong, and the last run was green. A workflow doesn't rot gradually - it works until a morning when it doesn't start at all. One more date sits outside the file: Node 24 became the runner default on 2026-06-16, and the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true opt-out that pins actions back to Node 20 stops working on 2026-09-23 too.

Why the usual tools miss this

Dependabot and Renovate bump a uses: version when a new release appears - a different question from "when does this stop running". They never read runs-on: labels, so ubuntu-22.04 and macos-13 stay invisible, nor ::set-output, nor using: 'node20' in a composite action of your own. Code assistants are worse, not better: their training data predates these dates, so they'll autocomplete actions/checkout@v4 and runs-on: ubuntu-22.04 into the file you're fixing.

What to do this week

Already unsupported, so fix today: ubuntu-20.04 and ubuntu-18.04 to ubuntu-24.04, windows-2019 to windows-2025, macos-13 to macos-15, upload-artifact@v3 and download-artifact@v3 to @v6, cache@v1-v2 to @v5, ::set-output to $GITHUB_OUTPUT.

Dated, so fix before 2026-09-23: checkout@v1-v4 and setup-node@v1-v4 to @v5, upload-artifact@v4-v5 to @v6, cache@v3-v4 to @v5, setup-python@v1-v5 and setup-java@v1-v4 to @v6. And ubuntu-22.04 to ubuntu-24.04 before the 2026-09-17 brownouts.

Free, and what the licence buys

GitHub Actions Deprecation Lint is a VS Code extension carrying 25 of these dated rules and marking them by line number in the file you have open. That tier is free, asks for no key and has no watermark - the block at the top of this article is exactly what it prints. The same 25 rules also run on a web page with nothing installed.

The licence buys scope, not more rules - both tiers run the identical 25, so a paid answer is never a better answer, only a wider one. Free checks the one file in front of you, when you remember to ask. The licence scans every workflow in the repository in one pass, including the composite action.yml files where using: 'node20' hides; exports CSV, JSON or HTML for a migration ticket; prints JSON a CI step can fail on, so nobody reintroduces a dead version; and re-checks on every save, catching a pasted suggestion before commit. $29 once, one key per person or team seat.