github-actions-maintainer 0.7.5

General-purpose GitHub Actions maintenance toolkit with secure workflow pinning
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168

name: GitHub Actions Maintainer
author: ThreatFlux
description: Pin, update, report, and policy-scan GitHub Actions and cargo dependency versions, and cut conventional-commit releases, entirely through the GitHub API.
branding:
  icon: shield
  color: blue

inputs:
  command:
    description: Command to run. Use pin, update, status, policy, or release.
    required: false
    default: "pin"

  # Shared inputs (all commands).
  token:
    description: GitHub token. Optional for read-only commands; required for remote pull request creation and for release, and recommended everywhere to raise API rate limits.
    required: false
    default: ${{ github.token }}
  owner:
    description: Repository owner; defaults to the owner from GITHUB_REPOSITORY. (all commands)
    required: false
    default: ""
  repo-name:
    description: Repository name; defaults to the name from GITHUB_REPOSITORY. (all commands)
    required: false
    default: ""
  repo:
    description: Path to the checked-out repository. (all commands)
    required: false
    default: "."
  base-branch:
    description: Base branch. For update it is the base of the dependency pull request; for release it is the branch to release from. Defaults to the repository default branch. (update and release)
    required: false
    default: ""
  dry-run:
    description: Analyze and report without writing files, commits, tags, releases, or pull requests. (all commands)
    required: false
    default: "false"
  create-pr:
    description: For update, open a dependency-update pull request instead of rewriting files locally. For release, stage the release on an automation-owned release pull request instead of publishing directly to the base branch. (update and release)
    required: false
    default: "false"
  commit-message:
    description: 'Commit message. Leave empty to use the per-command default ("Update dependencies" for update; "chore: release v{version}" for release, where "{version}" is replaced with the new version). (update and release)'
    required: false
    default: ""

  # Maintainer inputs (pin, update, status, policy).
  workflows-path:
    description: Relative path to the workflow directory beneath the repository root. (pin, update, status, and policy only)
    required: false
    default: ".github/workflows"
  github-actions:
    description: Include GitHub Actions workflow updates. (update and status only)
    required: false
    default: "false"
  cargo:
    description: Include cargo package dependency updates. (update and status only)
    required: false
    default: "false"
  all:
    description: Include both GitHub Actions and cargo package updates. (update and status only)
    required: false
    default: "false"
  branch-name:
    description: Override the branch name used for the dependency-update pull request. Leave empty to let the tool generate one. (update only)
    required: false
    default: ""
  labels:
    description: Comma-separated labels to add to the dependency-update pull request. Leave empty to use the default ("dependencies"). (update only)
    required: false
    default: ""
  title:
    description: Title for the dependency-update pull request. Leave empty to use the default ("Update dependencies"). (update only)
    required: false
    default: ""

  # Policy inputs (policy only).
  check-scripts:
    description: Report explicit Bash/sh and Python usage in run and shell blocks. (policy only)
    required: false
    default: "true"
  check-policies:
    description: Report unpinned actions, permission, and job timeout findings. (policy only)
    required: false
    default: "true"
  fail-on-findings:
    description: Fail the action when the scan reports any finding. (policy only)
    required: false
    default: "false"

  # Release inputs (release only).
  bump:
    description: Version bump strategy. Use auto, major, minor, or patch. Leave empty to use the default (auto, derived from conventional commits). (release only)
    required: false
    default: ""
  tag-prefix:
    description: Prefix for release tags. Leave empty to use the default ("v"). (release only)
    required: false
    default: ""
  tag-style:
    description: How the release tag is created; annotated or lightweight. Leave empty to use the default (annotated). (release only)
    required: false
    default: ""
  update-major-alias:
    description: Also move the moving major alias tag (for example v1) to the new release. (release only)
    required: false
    default: "false"
  notes-file:
    description: Path where generated release notes are written, including on dry runs. Leave empty to use the default ("release_notes.md"). (release only)
    required: false
    default: ""
  release-branch:
    description: Automation-owned release branch used with create-pr. Must be automation/release or use the automation/release/ prefix. Leave empty to use the default ("automation/release"). (release only)
    required: false
    default: ""
  extra-files:
    description: Comma-separated repository-relative files to stage into the release commit on top of the manifest and lockfile version rewrites. Use it to pin a value that can only be resolved at release time, such as a runtime image digest, inside the commit the release tag points at. (release only)
    required: false
    default: ""
  phase:
    description: 'Which part of the release to perform: all (default) bumps, tags, and publishes in one run; bump commits the version bump and stops, so an artifact built from the released version can be published before the tag exists; tag then tags the version the manifest already holds. Leave empty to use the default ("all"). (release only)'
    required: false
    default: ""

outputs:
  released:
    description: Whether a release was created (true or false). Release-command output; empty for other commands.
  version:
    description: The released version without the tag prefix, empty when skipped without a computed version. Release-command output; empty for other commands.
  tag:
    description: The created release tag, empty when skipped without a computed version. Release-command output; empty for other commands.
  commit:
    description: SHA of the commit the release created, which for the bump phase is the version commit the follow-up tag phase builds on. Release-command output; empty for other commands.
  release-url:
    description: URL of the created GitHub Release, empty unless released. Release-command output; empty for other commands.
  notes-file:
    description: Path to the generated release notes file, empty when no notes were generated. Release-command output; empty for other commands.
  release-pr-number:
    description: Number of the created or updated automated release pull request. Release-command output; empty for other commands.
  release-pr-url:
    description: URL of the created or updated automated release pull request. Release-command output; empty for other commands.
  release-branch:
    description: Branch used for the automated release pull request. Release-command output; empty for other commands.

runs:
  using: docker
  image: runtime/Dockerfile
  # Only the flags every published binary accepts are passed positionally, so
  # this action keeps working while the pinned runtime image still holds an
  # older binary (--create-pr is rejected by pre-0.6.0 release subcommands, so
  # it is deliberately absent here). Every other input travels through the
  # INPUT_<NAME> environment variables GitHub sets automatically for Docker
  # container actions.
  args:
    - ${{ inputs.command }}
    - --repo
    - ${{ inputs.repo }}
    - --token
    - ${{ inputs.token }}
    - --owner
    - ${{ inputs.owner }}
    - --repo-name
    - ${{ inputs.repo-name }}
    - --base-branch
    - ${{ inputs.base-branch }}
    - --dry-run
    - ${{ inputs.dry-run }}