How to use the GitHub Actions Runtime Upgrade agent skill

What is an agent skill and what does this one do?

An agent skill is a folder containing a SKILL.md file with instructions that an AI agent (such as Claude) reads when a task matches the skill's description. This skill is one such folder. It only adds guidance; it does not run any code on its own.

When your workflow logs show that an action is running on a deprecated runtime, the skill guides the agent to upgrade those actions in the files under .github/workflows. It asks the agent to choose the latest stable major version that works with the workflow, resolve that release to a full commit SHA, and use the SHA in uses: instead of a mutable tag or branch.

• Pick the latest stable major version compatible with the workflow.
• Pin each action to a full commit SHA, with an optional version comment.
• Upgrade one action at a time per commit, or one tightly related group.
• Keep triggers, permissions and other workflow behaviour the same unless you intend to change them.
• Validate by re-running workflows and checking logs for new deprecation warnings.
• Note from-to upgrades, any action that could not move, and which workflows were re-run in the pull request.

Install the skill from the ZIP download

Download the ZIP file for this skill from this page. The skill is published as a single file, SKILL.md, so the ZIP contains that one file inside a folder. Unzip it into one of two locations, depending on how widely you want it available.

For all your projects, unzip it into ~/.claude/skills/ on your computer. To make it available only inside one repository, unzip it into that project's .claude/skills/ folder instead.

If you use the Claude apps rather than a local setup, you can upload the skill instead. Open Settings, go to Capabilities, then Skills, and upload the skill there.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside the repository
• Claude apps: Settings → Capabilities → Skills

Trigger the skill with a natural request

You do not need a special command. Describe the task in plain language and mention the warning or the workflow files. The skill is relevant when a workflow log reports an action running on a deprecated runtime, or when you are changing action versions in .github/workflows/*.yml or *.yaml files.

Good requests name the symptom and the scope. Be specific about which workflow or action you care about so the agent knows where to look.

• "Our CI log says actions/setup-node is running on a deprecated Node.js runtime. Upgrade it in .github/workflows/build.yml."
• "Upgrade the first-party actions in our workflows that show runtime deprecation warnings, one action per commit."
• "Update actions/checkout and actions/setup-python to supported runtimes and pin them to commit SHAs."

What the agent will produce

The skill focuses on setup actions under actions/setup-* (for example setup-node, setup-python and setup-dotnet) and any other action named in the runtime warning. Expect the agent to show a pinning pattern like the one below, where the full SHA is followed by a version comment.

The skill asks the agent to identify the latest compatible release first and then use its commit SHA. It does not ask the agent to verify those SHAs itself, so check them against the release page before merging.

What you need before you start

The skill needs access to the repository's .github/workflows files. The agent also needs a way to look up release commit SHAs: either network access, or you supply the SHAs yourself. To validate the change you need GitHub Actions to re-run the workflows, or equivalent local build and test commands.

The skill itself runs no scripts and uses no network access. Any lookup of release information depends on the environment the agent is running in.

• Read and write access to .github/workflows files in the repository
• A way to find release commit SHAs (network access, or SHAs you provide)
• GitHub Actions available to re-run workflows, or local build/test commands

Safety notes and when not to use it

Pinning to a SHA makes runs reproducible, but the skill cannot confirm that a SHA is correct. Review each SHA against the action's official release before accepting the change. Upgrading to the latest major can also break a workflow that depends on older behaviour, so the skill tells the agent to keep existing behaviour unchanged and to report any action that could not move to a new major and why.

Skip this skill if Dependabot already updates your workflows and you see no runtime warnings, since it adds little in that case. Also skip it for workflows that need a specific older action version for compatibility.

• The skill runs no scripts and makes no network calls itself; the agent may need network access to look up SHAs.
• Verify every SHA yourself before merging.
• Check triggers and permissions were not changed unintentionally.
• Do not use it if you need an older action version for compatibility.

Tips for a clean upgrade

Upgrade one action per commit so that a failing run points to a single cause. Keep the version comment next to each SHA so reviewers can see what it refers to. After the change, read the run logs for new deprecation notes, not just for a green checkmark.

The checklist in the skill also asks for release and artifact steps to be checked, since those can succeed while producing different output. Record the from-to versions in the pull request summary.

• Upgrade one action per commit or one related group.
• Keep the # vX.Y.Z comment beside each SHA.
• Read the logs for new deprecation warnings after re-running.
• Confirm release, signing and artifact steps still produce expected outputs.