Add GitHub Actions runtime upgrade skill

[jamesmontemagno]

Summary

• convert the contribution to a new Agent Skill: skills/github-actions-runtime-upgrade-conventions/SKILL.md
• include skill frontmatter and guidance for runtime deprecation upgrades in GitHub Actions workflows
• regenerate docs so the skill appears in docs/README.skills.md and is removed from docs/README.instructions.md

Validation

• npm start
• npm run skill:validate
• npm run plugin:validate
• bash eng/fix-line-endings.sh

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds a new instruction set to guide GitHub Actions “Node.js runtime deprecated” upgrades and surfaces it in the instructions catalog.

Changes:

• Added “GitHub Actions Runtime Upgrade Conventions” instruction file scoped to workflow YAMLs.
• Updated the docs instructions index to include an install link for the new instruction.

Show a summary per file

File	Description
instructions/github-actions-runtime-upgrade-conventions.instructions.md	New instruction content and frontmatter for workflow runtime upgrade guidance.
docs/README.instructions.md	Adds the new instruction to the documentation list with install links.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 1

[github-actions]

🔒 PR Risk Scan Results

Scanned 2 changed file(s).

Severity	Count
🔴 High	0
🟠 Medium	1
ℹ️ Info	0

Severity	Rule	File	Line	Match
🟠	package-exec-command	docs/README.skills.md	31	| [acreadiness-assess](../skills/acreadiness-assess/SKILL.md)<br />`gh skills install github/awesome-copilot acreadiness-assess` | Run the AgentRC readiness assessment on the curre

This is an automated soft-gate report. Findings indicate review targets and do not block merge by themselves.

[github-actions]

🔍 Skill Validator Results

✅ All checks passed

Scope	Checked
Skills	1
Agents	0
Total	1

Severity	Count
❌ Errors	0
⚠️ Warnings	0
ℹ️ Advisories	0

Summary

Level	Finding
ℹ️	Found 1 skill(s)
ℹ️	[github-actions-runtime-upgrade-conventions] 📊 github-actions-runtime-upgrade-conventions: 606 BPE tokens [chars/4: 722] (detailed ✓), 8 sections, 1 code blocks
ℹ️	✅ All checks passed (1 skill(s))

Full validator output

Found 1 skill(s)
[github-actions-runtime-upgrade-conventions] 📊 github-actions-runtime-upgrade-conventions: 606 BPE tokens [chars/4: 722] (detailed ✓), 8 sections, 1 code blocks
✅ All checks passed (1 skill(s))

[aaronpowell]

How is this skill different to having dependabot running on a repo monitoring workflows?

[jamesmontemagno]

This skill helps the agent update my actions correctly. Not everyone has dependabot on in every repo

[jamesmontemagno]

Addressed the review feedback in 3cd8033:\n\n- generalized targeting from a fixed action list to first-party \�ctions/\ with priority on \�ctions/setup-\n- updated pinning guidance to prefer immutable SHA pins resolved from the latest compatible release (and avoid mutable tag/branch pins)\n- added a concrete YAML pinning example block\n- added a short section clarifying how this skill complements Dependabot (especially for repos without it enabled)\n\nI also reran local validation (build + skill/plugin validators).