github-actions-2025

Q: How do I install github-actions-2025?

Run npx skills add https://github.com/josiahsiegel/claude-plugin-marketplace --skill github-actions-2025 in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/github-actions-2025/ (personal) or .claude/skills/github-actions-2025/ (project).

by josiahsiegelDevOps & Cloud

GitHub Actions 2025-2026 features and modernization. PROACTIVELY activate for: (1) 1 vCPU Linux runners (October 2025 public preview), (2) immutable releases for hardened distribution, (3) Node24 migration from Node20, (4) reusable workflows and composite actions, (5) workflowdispatch with rich inputs, (6) artifact attestations and provenance, (7) ARC (Actions Runner Controller) for self-hosted Kubernetes, (8) larger runners and macOS Apple Silicon runners, (9) deployment environments and protection rules, (10) OIDC federation to AWS/Azure/GCP. Provides: workflow templates, runner-selection matrix, OIDC setup recipes, attestation patterns, and Node24 migration steps.

Installs: 162
Last 24h: —
Trending rank: —
Security: Not audited

Install

Works with every agent the skills CLI supports.

npx skills add https://github.com/josiahsiegel/claude-plugin-marketplace --skill github-actions-2025

01
Install
Run the command in your project. The CLI asks which agents to install for.
02
Describe the task
Ask your agent for something this skill covers. It loads github-actions-2025 automatically when relevant.
03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.

SKILL.md

The instructions your agent reads when the skill is triggered.

GitHub Actions 2025 Features

1 vCPU Linux Runners (October 2025 - Public Preview)

What: New lightweight runners optimized for automation tasks with lower cost.

Specs:

1 vCPU
5 GB RAM
15-minute job limit
Optimized for short-running tasks

When to Use 1 vCPU Runners

Ideal for:

Issue triage automation
Label management
PR comment automation
Status checks
Lightweight scripts
Git operations (checkout, tag, commit)
Notification tasks

NOT suitable for:

Build operations
Test suites
Complex CI/CD pipelines
Resource-intensive operations

Usage

# .github/workflows/automation.yml
name: Lightweight Automation

on:
  issues:
    types: [opened, labeled]

jobs:
  triage:
    runs-on: ubuntu-latest-1-core  # New 1 vCPU runner
    timeout-minutes: 10  # Max 15 minutes
    steps:
      - name: Triage Issue
        run: |
          echo "Triaging issue..."
          gh issue edit ${{ github.event.issue.number }} --add-label "needs-review"

Cost Savings Example

# Before: Using 2 vCPU runner for simple task
jobs:
  label:
    runs-on: ubuntu-latest  # 2 vCPU, higher cost
    steps:
      - name: Add label
        run: gh pr edit ${{ github.event.number }} --add-label "reviewed"

# After: Using 1 vCPU runner (lower cost)
jobs:
  label:
    runs-on: ubuntu-latest-1-core  # 1 vCPU, 50% cost reduction
    timeout-minutes: 5
    steps:
      - name: Add label
        run: gh pr edit ${{ github.event.number }} --add-label "reviewed"

Immutable Releases (August 2025)

What: Releases can now be marked immutable - assets and Git tags cannot be changed or deleted once released.

Benefits:

Supply chain security
Audit compliance
Prevent tampering
Trust in release artifacts

Create Immutable Release

# Using GitHub CLI
gh release create v1.0.0 \
  dist/*.zip \
  --title "Version 1.0.0" \
  --notes-file CHANGELOG.md \
  --immutable

# Verify immutability
gh release view v1.0.0 --json isImmutable

GitHub Actions Workflow

# .github/workflows/release.yml
name: Create Immutable Release

on:
  push:
    tags:
      - 'v*'

jobs:
  release:
    runs-on: ubuntu-latest
    permissions:
      contents: write

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Build artifacts
        run: npm run build

      - name: Create Immutable Release
        uses: actions/github-script@v7
        with:
          script: |
            const fs = require('fs');
            const tag = context.ref.replace('refs/tags/', '');

            await github.rest.repos.createRelease({
              owner: context.repo.owner,
              repo: context.repo.repo,
              tag_name: tag,
              name: `Release ${tag}`,
              body: fs.readFileSync('CHANGELOG.md', 'utf8'),
              draft: false,
              prerelease: false,
              make_immutable: true  # Mark as immutable
            });

      - name: Upload Release Assets
        run: gh release upload ${{ github.ref_name }} dist/*.zip --clobber

Immutable Release Policy

# Organizational policy for immutable releases
name: Enforce Immutable Releases

on:
  release:
    types: [created]

jobs:
  enforce-immutability:
    runs-on: ubuntu-latest
    if: "!github.event.release.immutable && startsWith(github.event.release.tag_name, 'v')"

    steps:
      - name: Fail if not immutable
        run: |
          echo "ERROR: Production releases must be immutable"
          exit 1

Node24 Migration (September 2025)

What: GitHub Actions migrating from Node20 to Node24 in fall 2025.

Timeline:

September 2025: Node24 support added
October 2025: Deprecation notices for Node20
November 2025: Node20 phase-out begins
December 2025: Full migration to Node24

Update Your Actions

Check Node version in actions:

# Old - Node20
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-node@v3
        with:
          node-version: '20'  # Update to 24

# New - Node24
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/setup-node@v4
        with:
          node-version: '24'  # Current LTS

Runner Version Compatibility

# Ensure runner supports Node24
jobs:
  test:
    runs-on: ubuntu-latest  # Runner v2.328.0+ supports Node24

    steps:
      - name: Verify Node version
        run: node --version  # Should show v24.x.x

Custom Actions Migration

If you maintain custom actions:

// action.yml
runs:
  using: 'node24'  // Updated from 'node20'
  main: 'index.js'

# Update dependencies
npm install @actions/core@latest
npm install @actions/github@latest

# Test with Node24
node --version  # Ensure 24.x
npm test

Actions Environment Variables (May 2025)

What: Actions environments now available for all plans (public and private repos).

Environment Protection Rules

# .github/workflows/deploy.yml
name: Deploy to Production

on:
  push:
    branches: [main]

jobs:
  deploy:
    runs-on: ubuntu-latest
    environment:
      name: production
      url: https://app.example.com

    steps:
      - name: Deploy
        run: |
          echo "Deploying to ${{ vars.DEPLOY_URL }}"
          # Deployment steps...

Environment configuration:

Settings → Environments → production
Add protection rules:
- Required reviewers
- Wait timer
- Deployment branches (only main)

Allowed Actions Policy Updates (August 2025)

What: Enhanced governance with explicit blocking and SHA pinning.

Block Specific Actions

# .github/workflows/policy.yml
# Repository or organization settings
allowed-actions:
  verified-only: true

  # Explicitly block actions
  blocked-actions:
    - 'untrusted/action@*'
    - 'deprecated-org/*'

  # Require SHA pinning for security
  require-sha-pinning: true

SHA Pinning for Security

# Before: Version pinning (can be changed by action maintainer)
- uses: actions/checkout@v4

# After: SHA pinning (immutable)
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # v4.1.1

Generate SHA-Pinned Actions

# Get commit SHA for specific version
gh api repos/actions/checkout/commits/v4.1.1 --jq '.sha'

# Or use action-security tool
npx pin-github-action actions/checkout@v4
# Output: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11

Copilot-Triggered Workflows (April 2025)

What: Workflows triggered by Copilot-authored events now require explicit approval.

Configure Copilot Workflow Approval

# .github/workflows/copilot-automation.yml
name: Copilot PR Automation

on:
  pull_request:
    types: [opened]

jobs:
  copilot-review:
    runs-on: ubuntu-latest

    # Copilot-generated PRs require approval
    if: github.event.pull_request.user.login != 'github-copilot[bot]'

    steps:
      - name: Auto-review
        run: gh pr review --approve

Manual approval required for Copilot PRs (same mechanism as fork PRs).

Artifact Storage Architecture (February 2025)

What: Artifacts moved to new architecture on February 1, 2025.

Breaking changes:

actions/upload-artifact@v1-v2 retired March 1, 2025
Must use actions/upload-artifact@v4+

Migration

# Old (Retired)
- uses: actions/upload-artifact@v2
  with:
    name: build-artifacts
    path: dist/

# New (Required)
- uses: actions/upload-artifact@v4
  with:
    name: build-artifacts
    path: dist/
    retention-days: 30

Windows Server 2019 Retirement (June 2025)

What: windows-2019 runner image fully retired June 30, 2025.

Migration

# Old
jobs:
  build:
    runs-on: windows-2019  # Retired

# New
jobs:
  build:
    runs-on: windows-2022  # Current
    # Or windows-latest (recommended)

Meta API for Self-Hosted Runners (May 2025)

What: New actions_inbound section in meta API for network configuration.

# Get network requirements for self-hosted runners
curl https://api.github.com/meta | jq '.actions_inbound'

# Configure firewall rules based on response
{
  "domains": [
    "*.actions.githubusercontent.com",
    "*.pkg.github.com"
  ],
  "ip_ranges": [
    "140.82.112.0/20",
    "143.55.64.0/20"
  ]
}

Best Practices for 2025

1. Use Appropriate Runners

# Use 1 vCPU for lightweight tasks
jobs:
  label-management:
    runs-on: ubuntu-latest-1-core
    timeout-minutes: 5

  # Use standard runners for builds/tests
  build:
    runs-on: ubuntu-latest

2. Immutable Releases for Production

# Always mark production releases as immutable
- name: Create Release
  run: gh release create $TAG --immutable

3. SHA Pinning for Security

# Pin actions to SHA, not tags
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11
- uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8

4. Update to Node24

# Use latest Node version
- uses: actions/setup-node@v4
  with:
    node-version: '24'

5. Environment Protection

# Use environments for deployments
jobs:
  deploy:
    environment: production
    # Requires approval, wait timer, branch restrictions

Troubleshooting

1 vCPU runner timeout:

# Ensure task completes within 15 minutes
jobs:
  task:
    runs-on: ubuntu-latest-1-core
    timeout-minutes: 10  # Safety margin

Node24 compatibility issues:

# Test locally with Node24
nvm install 24
nvm use 24
npm test

Artifact upload failures:

# Use v4 of artifact actions
- uses: actions/upload-artifact@v4  # Not v1/v2

Resources

FAQ

What does the github-actions-2025 skill do?

How do I install github-actions-2025?

Run npx skills add https://github.com/josiahsiegel/claude-plugin-marketplace --skill github-actions-2025 in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/github-actions-2025/ (personal) or .claude/skills/github-actions-2025/ (project).

Which AI agents can use github-actions-2025?

Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.

Is github-actions-2025 safe to install?

No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.

Who maintains github-actions-2025?

It is published by josiahsiegel in josiahsiegel/claude-plugin-marketplace. It has 162 recorded installs.