Your CI is green on runtimes that no longer exist

Description and use

CI pipelines often claim to test on specific runtimes and use particular actions, but in reality they use outdated versions, ignore lockfiles, leading to false green badges.

Problem

CI pipelines often claim to test on certain runtimes, use specific actions, and install dependencies, but the actual configuration may use end‑of‑life runtimes, outdated actions, or ignore lockfiles, leading to false green badges.

Outcome

The analysis reveals that the CI pipeline falsely claims coverage on EOL runtimes, uses outdated actions, and ignores lockfiles, resulting in a misleading green badge.

Workflow

• Review pinned runtimes in .github/workflows/*.yml and verify they are not EOL.
• Check action major versions; ensure they are current and supported.
• Ensure dependency installation commands use frozen lockfiles (e.g., yarn install --frozen-lockfile).
• Verify that workflow triggers match claimed coverage (e.g., main branch tests).

Evidence

All three are end-of-life. Node 14 died in April 2023, 16 in September 2023, 18 in April 2025.

Source

Both pinned to @v2, two majors behind. v2 actions run on a Node runtime GitHub has been deprecating for a while.

Source

yarn install, no --frozen-lockfile. Lockfile drift cannot fail the build.

Source