Your CI is green on runtimes that no longer exist

Описание и применение

CI‑пайплайны часто заявляют о тестировании на определённых рантаймах и использовании конкретных действий, но на практике используют устаревшие версии, игнорируют lockfile, что приводит к ложным зелёным статусам.

Задача

CI pipelines often claim to test on certain runtimes, use specific actions, and install dependencies, but the actual configuration may use end‑of‑life runtimes, outdated actions, or ignore lockfiles, leading to false green badges.

Результат

The analysis reveals that the CI pipeline falsely claims coverage on EOL runtimes, uses outdated actions, and ignores lockfiles, resulting in a misleading green badge.

Рабочий процесс

• Review pinned runtimes in .github/workflows/*.yml and verify they are not EOL.
• Check action major versions; ensure they are current and supported.
• Ensure dependency installation commands use frozen lockfiles (e.g., yarn install --frozen-lockfile).
• Verify that workflow triggers match claimed coverage (e.g., main branch tests).

Доказательства

All three are end-of-life. Node 14 died in April 2023, 16 in September 2023, 18 in April 2025.

Источник

Both pinned to @v2, two majors behind. v2 actions run on a Node runtime GitHub has been deprecating for a while.

Источник

yarn install, no --frozen-lockfile. Lockfile drift cannot fail the build.

Источник