GitHub Actions · July 2026

Migrate Actions workflows to Node 24 without blind version bumps.

GitHub began using Node 24 by default on Actions runners on June 16, 2026. For workflows on GitHub.com, the safe response is a small dependency migration: inventory every action ref, read release metadata, preserve inputs and permissions, verify the actual runner, and test the real workflow. GitHub Enterprise Server artifact handling is called out separately below.

Short version: do not search-and-replace every @v4 with @v7. A major action upgrade can change behavior. Map the ref to official releases, review every intervening major, patch deliberately, run the workflow, then remove any temporary Node 20 opt-out.

The dates and compatibility boundary.

April 2026Node 20 reached end of life.
June 16, 2026GitHub says runners began using Node 24 by default.
Fall 2026GitHub plans to remove Node 20 from the runner. The temporary ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true opt-out stops working after that removal.

Node 24 is incompatible with macOS 13.4 or earlier and lacks official ARM32 support. The verified Node 24 releases below require Actions Runner v2.327.1 or later. Those constraints matter most for self-hosted runners, where the repository owner controls the runner version, host OS, and architecture.

Start with a local inventory.

Paste sanitized GitHub.com workflow YAML into the browser-only checker. It tracks eight GitHub-owned refs across six action families, keeps verified Node 24 floors separate from dated latest-release snapshots, and sends pinned SHAs, local or third-party actions, and ambiguous refs to manual review. It neither uploads nor edits the workflow.

Check a workflow locally →

A reviewable migration sequence.

  1. Inventory every uses: ref. Include reusable workflows and composite/local actions referenced by the job.
  2. Resolve the real version. For a full commit SHA, map it to an official tag or inspect that commit's action.yml. Immutability is valuable, but a SHA alone does not reveal the bundled JavaScript runtime.
  3. Read intervening release notes. Major upgrades can alter inputs, outputs, defaults, prerequisites, or artifact behavior. Preserve only the permissions and inputs the workflow still needs.
  4. Verify the runner. Use Actions Runner v2.327.1 or later, update self-hosted runner software through its documented process, check OS and architecture compatibility, and inspect labels that may route jobs to older hosts.
  5. Patch one dependency group at a time. Keep the diff small enough to attribute a failure to a specific action or runner change.
  6. Run the real job path. Static checks cannot reproduce credentials, service containers, matrices, caches, artifacts, or third-party availability.
  7. Remove the Node 20 opt-out. Treat ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION as a short-lived rollback aid, never as the completed migration.

Verified Node 24 floors and latest snapshot.

As of July 22, 2026, these are the GitHub.com release lines used by this guide and checker. An action at or above the verified Node 24 floor does not need a latest-major upgrade solely for this runtime migration. Re-check official releases when applying the guide later.

ActionNode 24 floorLatest snapshotMigration handling
actions/checkoutv5.0.0v7.0.1Review repository checkout assumptions before any major upgrade.
actions/cache
actions/cache/restore
actions/cache/save		v5.0.0v6.1.0Review cache service, runner, path, key, restore-key, and cross-OS assumptions.
actions/download-artifactv7.0.0v8.0.1GitHub.com only; review artifact source, pattern, merge, path, permissions, and firewall requirements.
actions/setup-nodev5.0.0v7.0.0Preserve Node selection, registry, mirror, and cache inputs intentionally.
actions/setup-pythonv6.0.0v7.0.0Review runtime/tool-cache prerequisites and Python selection.
actions/upload-artifactv6.0.0v7.0.1GitHub.com only; review artifact naming, path, retention, overwrite, and hidden-file behavior.

GitHub Enterprise Server needs a separate artifact path.

The official upload-artifact support matrix says v4 and later are not supported on GitHub Enterprise Server. For GHES, it directs Node 24 users to actions/upload-artifact@v3.2.2. The official download-artifact matrix likewise says v4 and later are not supported on GHES, but currently points to v3 (Node 16) or v3-node20 (Node 20), not a Node 24 line. Do not copy the GitHub.com artifact examples into GHES. Verify the support matrix for the installed GHES release and every other action independently.

GitHub.com example target, not a universal patch.

steps:
  - uses: actions/checkout@v7
  - uses: actions/setup-node@v7
    with:
      node-version-file: .nvmrc
      cache: npm
  - run: npm ci
  - run: npm test
  - uses: actions/upload-artifact@v7
    if: always()
    with:
      name: test-results
      path: test-results/

Use a full reviewed commit SHA instead of a moving major tag when your dependency policy requires immutable refs. The correct SHA must come from the intended official release; this guide deliberately does not publish a copied SHA that could become stale or be pasted into the wrong action.

Inspect the clearly labeled synthetic before/after, change-by-change sources, and narrow repository-local hosted evidence →

Three risky shortcuts.

Boundary: a current action ref and compatible runner are prerequisites, not proof that the job will pass. Run the exact matrix and inspect its first actionable failure. Do not share secrets, credentials, private logs, proprietary source, or production details in public intake.

Primary references.

Still stuck on one workflow?

CI Rescue provides an action-ref inventory, reviewed minimal migration patch, runner or GHES compatibility notes, and verification report for one defined Node 24 migration goal. Scope and the exact Bitcoin amount are confirmed in writing before payment; no credentials or production access are accepted.

Open the preselected $49 Node 24 intake — no payment yet →