GitHub Actions Deprecation Lint: the 2026 runner and action EOL dates

Five lines in an ordinary GitHub Actions release workflow stop running on dates GitHub has already published, and the platform engineers who own those files hit the first of them on 2026-09-23. Nothing in the file looks wrong. The last run was green. The dates are the whole problem: a workflow does not rot gradually, it works perfectly until a morning when it does not start at all.

Here is a release workflow that passes today.

jobs:
  build:
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '18'
      - run: echo "::set-output name=version::1.4.0"
      - uses: actions/upload-artifact@v3

Every line above is already dated:

• runs-on: ubuntu-20.04 — the image became fully unsupported on 2025-04-15. The job cannot start.
• actions/checkout@v4 and actions/setup-node@v4 — both run on Node 20. Node 24 became the runner default on 2026-06-16, and Node 20 is removed from the runner on 2026-09-23. Move to @v5.
• node-version: '18' — Node 18 reached end-of-life on 2025-04-30 and gets no security patches.
• ::set-output — disabled on 2023-06-01 and silently ignored since. Write to $GITHUB_OUTPUT.
• actions/upload-artifact@v3 — shut down on 2025-01-30. Move to @v6; v4 made artifacts immutable, so a job that uploaded the same name twice needs the merge-multiple pattern.

And two more are queued behind them. ubuntu-22.04 and ubuntu-22.04-arm enter deprecation on 2026-09-17 and are fully unsupported on 2027-04-17. The ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true opt-out that pins actions back to Node 20 stops working on 2026-09-23 as well — it buys nothing after that date.

Why the usual tools miss this

Dependabot and Renovate bump a uses: version when a new release appears. That is a different question from "when does this stop running". They never read runs-on: labels, so ubuntu-22.04 and macos-13 stay invisible. They never read ::set-output, or using: 'node20' in a composite action you wrote yourself. And they cannot tell you that actions/upload-artifact@v5 still defaults to Node 20 while v6 does not — that distinction is not in a version number, it is in a changelog entry.

Code assistants are worse here, not better: their training data predates most of these dates, so they will happily autocomplete actions/checkout@v4 and runs-on: ubuntu-22.04 into a file you are trying to fix.

What to do this week

Open each workflow, and check it against the dates rather than against the version numbers. The replacements are all published:

All of the v5/v6 actions need Actions Runner 2.327.1 or later, which GitHub-hosted runners already have.

GitHub Actions Deprecation Lint is a VS Code extension that carries 25 of these dated rules and marks them by line number in the file you have open. That part is free and asks for no key — one file, all 25 rules, no watermark. A licence changes the scope rather than the depth: the whole repository in one pass, an exported report, and JSON a CI step can fail on so nobody reintroduces a dead version. The same 25 rules also run in the browser with nothing installed.