| name | github-actions-versions |
| description | Pin GitHub Actions to current, non-deprecated major versions when writing or editing GitHub Actions workflows. Use this skill whenever creating or modifying a file under .github/workflows/, writing or reviewing CI/CD YAML, or adding/ changing any `uses:` step — even when the user does not mention versions at all. Model training data lags behind real releases and tends to emit stale versions such as `actions/checkout@v4` or `actions/setup-node@v4`. Always consult the pinned version table in this skill instead of relying on remembered versions. |
GitHub Actions Versions
When you write or edit a GitHub Actions workflow, the uses: references you emit
from memory are frequently out of date — actions/checkout@v4 is the classic
example. This skill exists to override that habit. Before producing any uses:
line, look it up in the table below and use the pinned major version.
Core rule
For every uses: owner/repo@<ref> step:
- If the action is in the Pinned versions table, use the exact major tag
listed there (e.g.
actions/checkout@v7).
- If the action is not in the table, do not guess a version from memory.
Either look it up (e.g. the action's GitHub releases page) or tell the user
you are leaving it unpinned/unverified and why. Silently emitting a remembered
version is the failure mode this skill prevents.
- Never emit a version you know to be deprecated (
actions/checkout@v4,
actions/upload-artifact@v3, actions/*-pages@vN mismatches, Node 16/20-only
majors, etc.) even if the surrounding file or the user's example uses it. If
the user's existing file uses an old version, upgrade it and mention the bump.
Pinned versions
Last verified: 2026-06-23. These are floating major tags. They move
forward automatically within a major version (patch/minor), which is the GitHub-
recommended default for readability. See "Pinning policy" for the stricter SHA
option.
GitHub-official (actions/*)
uses: | Pin | Notes |
|---|
actions/checkout | @v7 | Node24. v7 (2026-06) blocks fork PR checkout in pull_request_target by default. |
actions/setup-node | @v6 | Node24; auto-caches npm when packageManager is set in package.json. |
actions/setup-python | @v5 | |
actions/setup-go | @v5 | |
actions/cache | @v5 | Node24. |
actions/upload-artifact | @v7 | Immutable artifacts; archive: false allows unzipped single-file uploads. |
actions/download-artifact | @v8 | Pairs with upload-artifact v7 direct uploads. |
actions/configure-pages | @v5 | |
actions/upload-pages-artifact | @v3 | Must be deployed with deploy-pages@v4 or newer. |
actions/deploy-pages | @v4 | Requires id-token: write + pages: write permissions. |
actions/github-script | @v8 | Node24. |
Docker
uses: | Pin | Notes |
|---|
docker/setup-qemu-action | @v4 | For multi-platform (arm64) emulation. |
docker/setup-buildx-action | @v4 | Run before build-push-action for cache + multi-platform. |
docker/login-action | @v4 | |
docker/metadata-action | @v6 | Generates tags/labels. |
docker/build-push-action | @v7 | |
JS/TS runtimes & package managers
uses: | Pin | Notes |
|---|
pnpm/action-setup | @v4 | The established pnpm installer. (A newer all-in-one pnpm/setup@v1 also installs a runtime; only use it if the user asks.) |
oven-sh/setup-bun | @v2 | |
denoland/setup-deno | @v2 | Defaults to Deno v2.x; supports cache: true. |
Deploy / release / coverage / security
uses: | Pin | Notes |
|---|
cloudflare/wrangler-action | @v3 | Action major is v3; it defaults to installing Wrangler v4. Pin wranglerVersion: if a specific CLI is needed. |
softprops/action-gh-release | @v2 | Needs contents: write. |
codecov/codecov-action | @v7 | |
github/codeql-action | @v4 | The init/analyze/autobuild steps all share this version. |
Rust
uses: | Pin | Notes |
|---|
dtolnay/rust-toolchain | @stable | This action is referenced by a rolling channel tag (@stable, @nightly, @1.85.0), not a vN major tag. Do not write @v1. |
Swatinem/rust-cache | @v2 | Place after the toolchain step. |
Pinning policy
The table uses floating major tags (@v7). This is the default GitHub recommends
for readability and is what to emit unless the user asks for something stricter.
If the user wants maximum supply-chain hardening, pin to a full commit SHA with
the version in a trailing comment instead:
- uses: actions/checkout@<40-char-sha>
SHA pins do not auto-receive patch updates, so they need Dependabot/Renovate to
stay current. Offer this only when the user signals security sensitivity; don't
fabricate a SHA — if you don't have the real commit hash, emit the major tag and
say a SHA can be added later.
Maintenance note
These pins were captured on the "Last verified" date and will drift. They are
a snapshot, deliberately not a live lookup, so workflow generation is fast and
deterministic. When a pin is clearly stale (a new major has shipped and the user
mentions it, or a deprecation warning is in play), say so and update, rather than
silently trusting the table forever. To refresh the whole table, re-check each
action's GitHub releases page (or gh api repos/<owner>/<repo>/releases/latest).
Examples
Example 1 — minimal Node CI (user said nothing about versions):
name: CI
on: [push, pull_request]
jobs:
test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v7
- uses: actions/setup-node@v6
with:
node-version: 24
cache: npm
- run: npm ci
- run: npm test
Example 2 — upgrading a stale file. User pastes a workflow using
actions/checkout@v4 and actions/setup-node@v4. Rewrite the uses: lines to
@v7 / @v6 and add a one-line note: "Bumped checkout v4→v7 and setup-node
v4→v6 (v4 of both is deprecated / runs on EOL Node)."
Example 3 — Deno + Cloudflare deploy:
- uses: actions/checkout@v7
- uses: denoland/setup-deno@v2
with:
deno-version: v2.x
- run: deno test -A
- uses: cloudflare/wrangler-action@v3
with:
apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
Example 4 — action not in the table. User adds peter-evans/create-pull-request.
It is not pinned here, so don't invent @v6 from memory — either look up its
current release or write the step and flag: "I left create-pull-request unpinned;
confirm the current major (or I can look it up)."
