actions-eol

Every GitHub Actions removal your workflows will hit, with the date: runner labels GitHub is retiring and their brownout windows, actions still on Node 20, artifact and cache versions that already fail, deprecated workflow commands, and pull_request_target's new default block. Each comes with the file and line and the one-line fix, from GitHub's own announcements.

npx --allow-remote=root https://agentwares.vercel.app/dl/actions-eol-0.2.0.tgz

No account. It reads your workflows on your machine, or through GitHub's API with your own token, and sends nothing about them to us.

Before GitHub removes a runner image it fails every job that asks for it during a few brownout windows. The first warning many teams get is a red build on a Monday afternoon. The next ones (read from GitHub's pages on 9 October 2026):

When (UTC)	What
12, 16, 19, 23, 26, 29, 30 Oct 2026, 14:00–24:00	macos-14, macos-14-large and macos-14-xlarge jobs fail (brownouts)
19 Oct to 19 Nov 2026	ubuntu-latest moves from Ubuntu 24.04 to 26.04
2 Nov 2026	macOS 14 removed; pull_request_target blocked by default in public repositories
Dec 2026	CodeQL Action v3 deprecated
23, 30 Mar and 6, 13 Apr 2027, 14:00–24:00	ubuntu-22.04 and ubuntu-22.04-arm jobs fail (brownouts)
17 Apr 2027	Ubuntu 22.04 removed
Aug 2027	macos-15-intel ends

Already in effect, and still in many workflows: Node 20 actions forced onto Node 24 (since 23 Sep 2026), artifact actions v1–v3 and actions/cache v1–v2 failing (since early 2025), set-env and add-path disabled, and set-output deprecated with no removal date.

What it prints

Recorded at noon UTC on 9 October 2026 over the synthetic repo in examples/demo-repo (node scripts/sample.mjs), not anyone's real code:

actions-eol 0.2.0 · read 6 files in examples/demo-repo · removal data checked 9 Oct 2026 (bundled)

7 removals will break a job here; 4 more only warn:

upload-artifact and download-artifact v1 to v3  ·  breaks a job
  when         stopped working 30 Jan 2025, 617 days ago
  after it     Jobs using actions/upload-artifact or actions/download-artifact v1, v2 or v3 fail on
               github.com. Pages deployments built on them (upload-pages-artifact before v3,
               deploy-pages before v4) fail too. GitHub Enterprise Server is not affected.
  found        actions/upload-artifact@v3  →  actions/upload-artifact@v6
                 .github/workflows/ci.yml:26 (uses)
  fix          Use actions/upload-artifact@v6 and actions/download-artifact@v7 (v4 works, on Node 20
               forced onto 24); for Pages, upload-pages-artifact@v5 and deploy-pages@v5.
  details      https://agentwares-agentcheck.vercel.app/actions/artifact-v3?ref=actions-eol

actions/cache v1 and v2, and pins below v3.4.0 or v4.2.0  ·  breaks a job
  when         stopped working 1 Mar 2025, 587 days ago
  after it     Jobs using actions/cache v1 or v2 fail, and so do exact pins of v3 below 3.4.0 or v4
               below 4.2.0: the legacy cache service they call was shut down. GitHub Enterprise
               Server is not affected.
  found        actions/cache@v4.1.2  →  actions/cache@v5
                 .github/workflows/ci.yml:19 (uses)
  fix          Use actions/cache@v5 (Node 24); if you pin a version or a commit, pin v5, or at least
               v4.2.0.
  details      https://agentwares-agentcheck.vercel.app/actions/cache-v2?ref=actions-eol

set-env and add-path workflow commands  ·  breaks a job
  when         disabled 16 Nov 2020, 2153 days ago
  after it     A step that prints ::set-env or ::add-path fails, unless
               ACTIONS_ALLOW_UNSECURE_COMMANDS is set to true, which reopens the injection hole the
               commands were removed for (CVE-2020-15228).
  found        ::add-path
                 .github/workflows/label.yml:12 (run)
  fix          Write echo "NAME=value" >> "$GITHUB_ENV" and echo "/some/dir" >> "$GITHUB_PATH".
  details      https://agentwares-agentcheck.vercel.app/actions/set-env?ref=actions-eol

Ubuntu 20.04 runner image  ·  breaks a job
  when         removed 15 Apr 2025, 542 days ago
  after it     Jobs that ask for ubuntu-20.04 are terminated with an error: the image is gone.
  found        ubuntu-20.04  →  ubuntu-24.04
                 .github/workflows/label.yml:6 (runs-on)
  fix          Change runs-on to ubuntu-24.04.
  details      https://agentwares-agentcheck.vercel.app/actions/ubuntu-20.04?ref=actions-eol

macOS 14 runner image  ·  breaks a job
  when         removed 2 Nov 2026, in 24 days
  brownouts    5, 12, 16, 19, 23, 26, 29 and 30 Oct 2026, 14:00 to 24:00 UTC; next 12 Oct 14:00 UTC,
               in 3 days
  after it     Jobs that ask for macos-14, macos-14-large or macos-14-xlarge are terminated with an
               error, and they fail during each brownout before then. GitHub may also cut macOS 14
               capacity, so queues get longer.
  found        macos-14  →  macos-15
                 .github/workflows/ci.yml:12 (matrix)
  fix          Change runs-on to macos-15 or macos-26 (macos-latest is macOS 26); macos-14-large to
               macos-15-large; macos-14-xlarge to macos-15-xlarge.
  details      https://agentwares-agentcheck.vercel.app/actions/macos-14?ref=actions-eol

pull_request_target in public repositories  ·  breaks a job
  when         blocked by default 2 Nov 2026, in 24 days
  after it     In a public repository with no Actions event policy, workflows triggered by
               pull_request_target stop running: GitHub's default workflow execution protection
               blocks the event. Private and internal repositories are exempt. The rule has run in
               evaluate mode since 17 Sep 2026, so its Insights show what it would block.
  found        pull_request_target
                 .github/workflows/label.yml:3 (on)
  fix          If the workflow needs pull_request_target, allow it in an Actions event policy for
               the repository or organisation (or allowlist that workflow file); otherwise trigger
               it on pull_request.
  details      https://agentwares-agentcheck.vercel.app/actions/pull-request-target?ref=actions-eol

Ubuntu 22.04 runner image  ·  breaks a job
  when         removed 17 Apr 2027, in 190 days
  brownouts    23 and 30 Mar, 6 and 13 Apr 2027, 14:00 to 24:00 UTC; next 23 Mar 14:00 UTC, in 165
               days
  after it     Jobs that ask for ubuntu-22.04 or ubuntu-22.04-arm are terminated with an error, and
               they fail during each brownout before then. While the image is deprecated, queues can
               be longer at peak hours.
  found        ubuntu-22.04  →  ubuntu-24.04
                 .github/workflows/ci.yml:12 (matrix)
  fix          Change runs-on to ubuntu-24.04 or ubuntu-26.04; ubuntu-22.04-arm to ubuntu-24.04-arm
               or ubuntu-26.04-arm.
  details      https://agentwares-agentcheck.vercel.app/actions/ubuntu-22.04?ref=actions-eol

Node 20 actions  ·  warns
  when         removed from the runners 23 Sep 2026, 16 days ago
  after it     Every JavaScript action that declares node20 (or node16 or node12) runs on Node 24
               instead, and the job carries an annotation naming it. The
               ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION opt-out no longer works, so an action that
               breaks on Node 24 has no way back. Self-hosted runners on macOS 13.4 or older, or on
               ARM32, are no longer supported.
  found        action.yml, this repository's own action: runs.using node20  →  runs.using: node24
                 action.yml:5 (runs.using)
               actions/checkout@v4 (node20, by its major tag)  →  actions/checkout@v5
                 .github/workflows/ci.yml:15 (uses)
               actions/labeler@v5 (node20, by its major tag)  →  actions/labeler@v6
                 .github/workflows/label.yml:8 (uses)
               actions/setup-node@v4 (node20, by its major tag)  →  actions/setup-node@v5
                 .github/workflows/ci.yml:16 (uses)
               actions/setup-python@v5 (node20, by its major tag)  →  actions/setup-python@v6
                 .github/actions/setup/action.yml:7 (uses)
               github/codeql-action/analyze@v3 (node20, by its major tag)  →  github/codeql-action/analyze@v4
                 .github/workflows/release.yml:15 (uses)
               github/codeql-action/init@v3 (node20, by its major tag)  →  github/codeql-action/init@v4
                 .github/workflows/release.yml:12 (uses)
               softprops/action-gh-release@v2 (node20, by its major tag)  →  softprops/action-gh-release@v3
                 .github/workflows/release.yml:16 (uses)
  fix          Bump each action to its first major on Node 24 (actions/checkout@v5, setup-node@v5,
               cache@v5, upload-artifact@v6, download-artifact@v7); in your own action.yml, set
               runs.using to node24.
  details      https://agentwares-agentcheck.vercel.app/actions/node20?ref=actions-eol

ubuntu-latest moving to Ubuntu 26.04  ·  warns
  when         moves to Ubuntu 26.04 between 19 Oct and 19 Nov 2026, starting in 10 days
  after it     Jobs on ubuntu-latest start running on Ubuntu 26.04 instead of 24.04, a share of jobs
               at a time, until the move is complete. Builds that rely on 24.04's packages, system
               libraries, compilers or prebuilt binaries may break; nothing in the workflow file
               changes.
  found        ubuntu-latest
                 .github/workflows/release.yml:8 (runs-on)
  fix          Run a branch on ubuntu-26.04 now to see what breaks; to stay on 24.04, change runs-on
               to ubuntu-24.04.
  details      https://agentwares-agentcheck.vercel.app/actions/ubuntu-latest?ref=actions-eol

CodeQL Action v3  ·  warns
  when         deprecated Dec 2026, in 53+ days (GitHub gives only the month)
  after it     GitHub stops updating CodeQL Action v3; new CodeQL analysis capabilities come only to
               v4. GitHub has not said that v3 stops running. v3 runs on Node 20, so it is already
               forced onto Node 24.
  found        github/codeql-action/analyze@v3  →  github/codeql-action/analyze@v4
                 .github/workflows/release.yml:15 (uses)
               github/codeql-action/init@v3  →  github/codeql-action/init@v4
                 .github/workflows/release.yml:12 (uses)
  fix          Change github/codeql-action/init, analyze, autobuild and upload-sarif from @v3 to
               @v4. Code scanning's default setup moves by itself.
  details      https://agentwares-agentcheck.vercel.app/actions/codeql-action-v3?ref=actions-eol

set-output and save-state workflow commands  ·  warns
  when         deprecated; no removal date (checked 9 Oct 2026)
  after it     Steps that print ::set-output or ::save-state still work and log a deprecation
               warning. GitHub postponed their removal on 24 July 2023 and has announced no new
               date. Since runner v2.332.0 (25 February 2026) it counts each job that uses them.
  found        ::set-output
                 .github/workflows/ci.yml:24 (run)
               @actions/core ^1.9.1 (core.setOutput writes ::set-output)  →  @actions/core ^1.10.0
                 package.json:6 (dependencies)
  fix          Write echo "name=value" >> "$GITHUB_OUTPUT" (and >> "$GITHUB_STATE" for save-state);
               in an action's own code, use @actions/core 1.10.0 or later.
  details      https://agentwares-agentcheck.vercel.app/actions/set-output?ref=actions-eol

Runner labels GitHub no longer lists (read 9 Oct 2026):

macos-11  ·  not a GitHub-hosted label any more
  after it     Unless a self-hosted runner carries it, jobs that ask for it do not run: GitHub's
               list of hosted runner labels no longer has it.
  found in     .github/workflows/label.yml:10 (runs-on)

Also used, with no date announced:

Windows Server 2022 runner image  ·  no deprecation announced (checked 9 Oct 2026)
  found in     .github/workflows/ci.yml:12 (matrix)
  details      https://agentwares-agentcheck.vercel.app/actions/windows-2022?ref=actions-eol

Runtime not read, so not checked for Node 20:

example-org/deploy-action@v1  ·  not in the bundled table, and --offline reads no action.yml
  found in     .github/workflows/release.yml:17 (uses)

An email before each brownout, for the repos you watch, is not built.
  It would re-read your workflows every day and email you a week and a day before each brownout or
  removal that would hit them, with no change to your repo. agentcheck's free hourly watch covers
  MCP servers only today. If you would pay for this one, say so with one click:
  https://agentwares-agentcheck.vercel.app/actions?ref=actions-eol#watch
Dates come from GitHub's own announcements, read on the day shown on each page. Every one: https://agentwares-agentcheck.vercel.app/actions

Not reported, on purpose, in the same files: runs-on: [self-hosted, ubuntu-22.04] (a self-hosted runner's labels are its owner's own), Test on ${{ matrix.os }} in a job name, and the local action ./.github/actions/setup, whose own action.yml is read instead.

Each finding links to a page with the sources: for example ubuntu-22.04 runner deprecated. Every removal, by date: agentwares-agentcheck.vercel.app/actions.

Usage

npx --allow-remote=root https://agentwares.vercel.app/dl/actions-eol-0.2.0.tgz [dir]               # default: the current directory
npx --allow-remote=root https://agentwares.vercel.app/dl/actions-eol-0.2.0.tgz owner/repo          # read it through GitHub's API
npx --allow-remote=root https://agentwares.vercel.app/dl/actions-eol-0.2.0.tgz . --json            # the report as JSON
npx --allow-remote=root https://agentwares.vercel.app/dl/actions-eol-0.2.0.tgz . --fail-within 14  # exit 1 when a break is 14 days away or nearer
npx --allow-remote=root https://agentwares.vercel.app/dl/actions-eol-0.2.0.tgz list                # the calendar; --all adds what is in effect
npx --allow-remote=root https://agentwares.vercel.app/dl/actions-eol-0.2.0.tgz demo                # the scan on the synthetic repo; no requests

• Reads .github/workflows/*.yml and *.yaml (GitHub reads no deeper), the repository's own action.yml, .github/actions/*/action.yml and package.json. It prints file names and line numbers, never a line.
• Finds runner labels where they choose a runner (runs-on, matrix values, inputs to reusable workflows), every uses: pin, ::set-output, ::save-state, ::set-env and ::add-path wherever a step prints them, on: pull_request_target, an action.yml that declares node20, and an @actions/core dependency below 1.10.0 (which writes set-output).
• Runtimes: an action's runtime is what its action.yml declares at the ref you pin. For about 40 widely used actions the major tags were read on 9 October 2026 and ship in the data; any other pin, an exact version or a commit, is read from raw.githubusercontent.com.
• owner/repo reads the default branch through GitHub's API: your GITHUB_TOKEN, GH_TOKEN or gh auth token, or none for a public repository (60 requests an hour). --anonymous sends none. The token goes only to api.github.com and is never printed or stored.
• Requests: GET https://agentwares-agentcheck.vercel.app/actions/removals.json for the data (the copy bundled with this version if it fails), and GETs to GitHub. --offline (or ACTIONS_EOL_OFFLINE=1) makes none and uses the bundled data and table.
• Exit codes: 0 when the scan ran, 1 for an error or when --fail-within is met, 2 for a usage mistake. With --json, an error is {"error": {"code", "cause", "fix", "retryable"}} on stdout.

--json gives summary (breaking, warnings, no_date, first), then per finding: id, name, severity (breaks or warns), status (upcoming, brownouts, moving, due, past), date, when, brownouts (each start, end and status), next (the next brownout or date and the days to it), after, fix, hits (each what, its fix, runtime and locations), source_url and page_url; then other, unlisted and unresolved.

In CI: the GitHub Action

# .github/workflows/actions-eol.yml
on:
  pull_request:
    paths: [".github/**", "action.yml", "action.yaml"]
  schedule:
    - cron: "17 7 * * 1"
permissions:
  contents: read
jobs:
  actions-eol:
    runs-on: ubuntu-24.04
    steps:
      - uses: actions/checkout@v5
      - uses: agentwares/actions-eol@main
        with:
          warn-days: 60
          fail-days: 14

It annotates each workflow line it finds: a warning warn-days ahead, an error fail-days before a brownout or removal (or once it is in effect), and the job fails on an error. Warning-only findings (Node 20 actions forced onto Node 24, the ubuntu-latest move, CodeQL v3) never fail it. The weekly run turns the check red as a date comes closer, even when nothing changed. The report goes to the step summary; outputs are breaking, warnings, next-date and report. With no checkout before it, it reads the repository through GitHub's API with the job's token. The whole example is in examples/github-workflow.yml.

An email before each brownout, for the repos you watch, is not built

It would re-read your workflows every day and email you a week and a day before each brownout or removal that would hit them, with no change to your repo. agentcheck's free hourly watch covers MCP servers only today. If you would pay for this one, the button on the removals page counts the click; nothing else is sent.

Inside Claude Code, and for agents

The repo is also a plugin marketplace with one skill, /actions-eol:actions-eol, which runs the scan and walks through each fix:

/plugin marketplace add agentwares/actions-eol                     # Claude Code, then:
/plugin install actions-eol@actions-eol
codex plugin marketplace add agentwares/actions-eol                # Codex, then pick it in /plugins
copilot plugin install agentwares/actions-eol:plugins/actions-eol  # GitHub Copilot CLI
npx skills add agentwares/actions-eol                              # the skill alone, for Cursor and other agents

In VS Code, add agentwares/actions-eol to the chat.plugins.marketplaces setting.

actions-eol mcp is a local MCP server over stdio with two read-only tools: actions_eol_scan_workflows (a path or owner/repo in, the report out) and actions_eol_list_removals (the calendar, or one entry).

Add it to Claude Code, VS Code or Cursor:

claude mcp add actions-eol -- npx -y --allow-remote=root https://agentwares.vercel.app/dl/actions-eol-0.2.0.tgz mcp

Install in VS Code · Add to Cursor

Where the dates come from

Only GitHub's own pages, each entry with its source and the day it was read (9 October 2026 for this version): the runner-images announcements and list of images, the GitHub changelog, the runner's releases, and each action's action.yml. GitHub's Ubuntu 22.04 notice writes each brownout as "March 23, 14:00 UTC - March 23, 00:00 UTC"; the data reads that as ending at 00:00 UTC the next day, as the macOS 14 notice in the same format spells out. github.com only: GitHub Enterprise Server keeps its own schedule.

License

MIT, by agentwares. actions-eol is a free tool from agentcheck, which runs scheduled checks of your endpoints and alerts you when an answer changes.