Zoltan Kochanandgithub-actions[bot]
91774e72a0
* chore(release): 11.28.7, pacquet 12.15.0, pnpr 0.1.0-alpha.16 * docs(release): curate 11.28.7, pacquet 12.15.0, and pnpr 0.1.0-alpha.16 release notes Add lead paragraphs and group the patch entries by what the reader was doing, with security fixes first on each page. - v11: lead with the registry metadata name check, pinned pnpm trustPolicy check, maxTarballUnpackedSize, and the removal of registry revisions; merge overlapping entries for minimumReleaseAge metadata revalidation, frozen-lockfile directory dependency checks, syncInjectedDepsAfterScripts, verifyDepsBeforeRun, pnpm sbom, and unreadable config settings. - v12: order minor highlights from config includes and lockfile.integrityTarget down to interactive update styling; drop the pnpr-only distribution note from the CLI changelog; merge overlapping entries for workspace and pnpr install speedups, minimumReleaseAge and If-Modified-Since revalidation, frozen-lockfile and injected package checks, verifyDepsBeforeRun, pnpm prune, pnpm pack, pnpm licenses list, pnpm self-update, pinned pnpm flag forwarding, and WebContainer fixes. - pnpr: lead the minor section with the breaking ecosystem URL prefix, hosted storage layout, artifacts.orgs, and strict config schema changes; fold dist.pnpr tarball metadata into one entry and drop the redundant /metrics note; lead the patch section with reserved-username and auth security fixes. - Use one issue-link label style across the release pages. --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
@pnpm/deps.github-actions
Discover and update GitHub Actions dependencies
Installation
pnpm add @pnpm/deps.github-actions
Usage
import {
findOutdatedGitHubActions,
updateGitHubActions,
} from '@pnpm/deps.github-actions'
const outdated = await findOutdatedGitHubActions({
dir: process.cwd(),
})
await updateGitHubActions({
dir: process.cwd(),
})
The package scans workflow files in .github/workflows and follows referenced local reusable workflows and composite actions. Only uses fields in jobs and steps are treated as dependencies.
Updates are always pinned to an exact commit SHA. The corresponding semantic version tag is written in a comment:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
By default, updateGitHubActions selects the newest caret-compatible release. This keeps 0.5.x releases below 0.6.0, since pre-1.0 minor releases may contain breaking changes. Set latest: true to allow incompatible updates. findOutdatedGitHubActions reports the newest release by default; set compatible: true to report only caret-compatible updates.
License
MIT