Your CI is green on runtimes that no longer exist

说明与用途

CI 流水线经常声称在特定运行时上进行测试并使用特定操作，但实际上它们使用过时的版本，忽略 lockfile，导致绿色徽章误导性。

问题

CI pipelines often claim to test on certain runtimes, use specific actions, and install dependencies, but the actual configuration may use end‑of‑life runtimes, outdated actions, or ignore lockfiles, leading to false green badges.

结果

The analysis reveals that the CI pipeline falsely claims coverage on EOL runtimes, uses outdated actions, and ignores lockfiles, resulting in a misleading green badge.

工作流

• Review pinned runtimes in .github/workflows/*.yml and verify they are not EOL.
• Check action major versions; ensure they are current and supported.
• Ensure dependency installation commands use frozen lockfiles (e.g., yarn install --frozen-lockfile).
• Verify that workflow triggers match claimed coverage (e.g., main branch tests).

证据

All three are end-of-life. Node 14 died in April 2023, 16 in September 2023, 18 in April 2025.

来源

Both pinned to @v2, two majors behind. v2 actions run on a Node runtime GitHub has been deprecating for a while.

来源

yarn install, no --frozen-lockfile. Lockfile drift cannot fail the build.

来源