GitHub Actions · evidence snapshot July 22, 2026

A reviewable Node 24 action-runtime migration, without a universal-success claim.

This page shows the kind of small, source-backed patch included in a focused migration review. The input, output, and diff are synthetic. They contain no client data and are not presented as paid-client work.

Synthetic example — not client work

The “before” workflow is a deliberately small migration input, not a captured customer failure. The “after” workflow is a review target for GitHub.com-hosted runners, not a promise that the job or any other repository will pass.

Clearly labeled synthetic before and after.

Synthetic BEFORE · temporary Node 20 path

name: CI
on: [push, pull_request]

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    env:
      ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
      - run: npm test

Synthetic AFTER · reviewed Node 24-capable refs

name: CI
on: [push, pull_request]

permissions:
  contents: read

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version-file: .nvmrc
          cache: npm
      - run: npm ci
      - run: npm test

Reviewable synthetic workflow diff.

 jobs:
   test:
     runs-on: ubuntu-latest
-    env:
-      ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version-file: .nvmrc
           cache: npm

Every changed line maps to primary evidence.

Diff change	Reason and boundary	Primary GitHub evidence
Remove the Node 20 opt-out	GitHub describes `ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true` as a temporary escape hatch and says it will stop working when Node 20 is removed from the runner. Removal is the completion criterion here, after compatible action refs and the real job are reviewed.	GitHub Changelog: Node 20 deprecation on Actions runners
`checkout@v4` → `checkout@v7`	`checkout@v5.0.0` is the documented Node 24 floor. This synthetic target uses the reviewed July 2026 snapshot `v7.0.1` and aligns with the ref currently exercised by this repository. A project can choose the floor or an immutable release SHA after reviewing intervening changes; `@v7` is not a universal requirement.	Node 24 floor: v5.0.0 Snapshot release: v7.0.1
`setup-node@v4` → `setup-node@v7`	`setup-node@v5.0.0` is the documented Node 24 floor. The existing `node-version-file` and `cache` inputs remain visible and unchanged; the example does not silently replace the project's Node version. As above, `@v7` is a reviewed example target, not a blind global replacement rule.	Node 24 floor: v5.0.0 Snapshot release: v7.0.0

“Node 24 migration” here refers to the JavaScript runtime bundled by GitHub Actions. It does not require changing the application runtime selected by setup-node. The release notes for both Node 24 floors require Actions Runner v2.327.1 or later.

What the real hosted run proves.

Repository-local evidence only

A successful GitHub-hosted site-check run at commit a3420d0 executed actions/checkout@v7 and actions/setup-node@v7 in this repository. The workflow revision is linked so those exact refs and inputs can be inspected.

That is the entire claim: those two current refs executed successfully in that one repository job. The run did not execute the synthetic workflow above, and its setup-node input selected project Node 22—not Node 24. It does not prove another workflow, matrix, runner, repository, or service will pass.

Inspect successful hosted run 29933717773 → Inspect workflow at the run's commit →

Have one workflow? Open the $49-equivalent Node 24 scope review — no payment yet →

Limits and non-generalization.

This is a synthetic example, not a paid-client result, endorsement, benchmark, or success guarantee.
It covers two GitHub-owned JavaScript actions on a GitHub.com-hosted ubuntu-latest job. It does not cover third-party, local, Docker, or composite actions.
It does not test pinned commit SHAs, self-hosted runner versions, macOS or ARM32 constraints, GitHub Enterprise Server, reusable workflows, artifacts, services, matrices, secrets, permissions beyond contents: read, or external dependencies.
Major action upgrades can change inputs, defaults, prerequisites, and behavior. Read every relevant release note and use immutable reviewed SHAs when policy requires them.
A clean static review and a green repository-local run are prerequisites and evidence, not proof of future hosted behavior. Run the exact job path and inspect its first actionable failure.
This is migration guidance, not a security review. Never submit credentials, private logs, proprietary source, or production details.

Primary references used for this proof.

Want this review for one workflow?

The $49-equivalent-in-Bitcoin scope includes one workflow, one action-ref inventory, a reviewed minimal migration patch, runner or GHES compatibility notes, a compact verification report, and one in-scope revision. Scope and the exact BTC amount are confirmed in writing before payment; hosted success is not guaranteed.

Open the preselected $49 Node 24 intake — no payment yet →

The link preselects “GitHub Actions Node 24 migration review” in the encrypted no-account intake. Add only sanitized evidence.