Zoltan Kochan
fca656586c
Teach `outdated`, interactive `update`, and opt-in non-interactive updates to discover GitHub Actions dependencies in workflow files and referenced local action definitions. Model actions as development dependencies so the existing production/development filters, compatible/latest behavior, explicit selectors, interactive selection, recursive workspace handling, and no-save/lockfile-only semantics remain consistent with package and runtime updates. Keep non-interactive updates package-only unless `--include-github-actions` is passed or `update.githubActions` is enabled in `pnpm-workspace.yaml`. Resolve semantic release tags through Git refs, but never persist a tag as the executable reference. Every changed action is pinned to the resolved commit SHA, with the semantic tag retained in an adjacent comment for readability and future version comparison. Non-semver and Docker references are left untouched. Implement the behavior in both the TypeScript CLI and pacquet and cover discovery, version selection, exact-SHA pinning, comment preservation, selector handling, and formatting preservation.
1.3 KiB
1.3 KiB
@pnpm/deps.github-actions
Discover and update GitHub Actions dependencies
Installation
pnpm add @pnpm/deps.github-actions
Usage
import {
findOutdatedGitHubActions,
updateGitHubActions,
} from '@pnpm/deps.github-actions'
const outdated = await findOutdatedGitHubActions({
dir: process.cwd(),
})
await updateGitHubActions({
dir: process.cwd(),
})
The package scans workflow files in .github/workflows and follows referenced local reusable workflows and composite actions. Only uses fields in jobs and steps are treated as dependencies.
Updates are always pinned to an exact commit SHA. The corresponding semantic version tag is written in a comment:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
By default, updateGitHubActions selects the newest caret-compatible release. This keeps 0.5.x releases below 0.6.0, since pre-1.0 minor releases may contain breaking changes. Set latest: true to allow incompatible updates. findOutdatedGitHubActions reports the newest release by default; set compatible: true to report only caret-compatible updates.
License
MIT