Pre-Consent Tracker Audit for EU Client Websites

Five lines in this release workflow stop running on published dates - platform engineers who own .github/workflows, the first date 2026-09-23. Here is the audit of that file, exactly as it prints:

.github/workflows/release.yml
   7  error  the ubuntu-20.04 runner image became fully unsupported on 2025-04-15 - the job fails to start. Use ubuntu-24.04.
   9  warn   actions/checkout@v1-v4 runs on Node 20. Node 20 is removed from GitHub-hosted runners on 2026-09-23 - move to actions/checkout@v5 (needs runner 2.327.1 or later).
  11  error  the ::set-output workflow command was disabled on 2023-06-01 and is now ignored - write to the $GITHUB_OUTPUT file instead.
  12  error  artifact actions v3 were shut down on 2025-01-30 - the step fails today. Move to v6 (v4 changed to immutable artifacts, so a job that uploaded the same name twice needs merge-multiple).
  14  warn   ubuntu-22.04 and ubuntu-22.04-arm enter deprecation on 2026-09-17 and are fully unsupported on 2027-04-17 - move to ubuntu-24.04 or ubuntu-26.04 before the brownouts start.

Three of those five are already fatal. This is the file they came from:

name: release
on:
  push:
    tags: ['v*']
jobs:
  build:
    runs-on: ubuntu-20.04
    steps:
      - uses: actions/checkout@v4
      - run: npm ci && npm run build
      - run: echo "::set-output name=version::1.4.0"
      - uses: actions/upload-artifact@v3
  smoke:
    runs-on: ubuntu-22.04

Nothing looks wrong, and the last run was green. A workflow doesn't rot gradually - it works until a morning when it doesn't start at all.

One more date sits outside the file. Node 24 became the runner default on 2026-06-16, and the ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true opt-out that pins actions back to Node 20 dies on 2026-09-23 too, so it buys nothing.

Why the usual tools miss this

Dependabot and Renovate bump a uses: version when a new release appears - a different question from "when does this stop running". They never read runs-on: labels, so ubuntu-22.04 and macos-13 stay invisible, nor ::set-output, nor using: 'node20' in a composite action of your own. And they can't tell you that upload-artifact@v5 still defaults to Node 20 while v6 doesn't - that isn't in a version number, it's in a changelog entry.

Code assistants are worse, not better: their training data predates these dates, so they autocomplete actions/checkout@v4 and runs-on: ubuntu-22.04 into the file you're fixing.

What to do this week

Check each workflow against the dates, not the version numbers. Already unsupported, so fix today: ubuntu-20.04 to ubuntu-24.04, windows-2019 to windows-2025, macos-13 to macos-15, upload-artifact@v3 to @v6, ::set-output to $GITHUB_OUTPUT.

Dated, so fix before 2026-09-23: checkout@v1-v4 and setup-node@v1-v4 to @v5, upload-artifact@v4-v5 to @v6, cache@v3-v4 to @v5, setup-python@v1-v5 to @v6. And ubuntu-22.04 to ubuntu-24.04 before the 2026-09-17 brownouts. The v5/v6 actions need Actions Runner 2.327.1 or later, which GitHub-hosted runners have.

Free, and what the licence buys

GitHub Actions Deprecation Lint is a VS Code extension carrying 25 of these dated rules, marked by line number in the file you have open. That tier is free, asks for no key and has no watermark - the block at the top of this article is exactly what it prints. The same 25 rules run on a web page too, nothing installed. Every date comes from GitHub's changelog and runner-images notes.

The licence buys scope, not more rules - both tiers run the identical 25. Free checks the one file in front of you. The licence scans every workflow in the repository in one pass, including the composite action.yml files where using: 'node20' hides; exports CSV, JSON or HTML; prints JSON a CI step can fail on; re-checks on every save; and takes your own rules for internal actions and runner labels. $29 once, one key per person or team seat.