update-github-actions

Files (1)

• SKILL.md

SKILL.md (first lines)

Update GitHub Actions in workflow files to their latest versions, pinned by commit SHA for security and reproducibility.

## Step 1 — Find workflow files

Glob for `.github/workflows/*.yml` and `.github/workflows/*.yaml`, plus local composite actions at `.github/actions/*/action.yml` and `.github/actions/*/action.yaml`. Read each file. If none are found, inform the user and stop.

Treat composite action files exactly like workflow files in the steps below: scan their `uses:` lines, apply the same ignore rules, and include them in the Step 4 table.

## Step 2 — Extract action references

For each workflow or composite action file, find all `uses:` lines that reference actions in `owner/repo@ref` format. Ignore:
- Local actions (paths starting with `./`)
- Docker actions (paths starting with `docker://`)
- Reusable workflow references (paths containing `.github/workflows/`)

Build a deduplicated list of actions with their current refs (e.g. `actions/checkout@v4`).

### Actions already pinned to a SHA

Actions pinned to a full 40-character SHA are still checked for updates. Determine their current version:

1. If the line has a trailing version comment (`uses: owner/repo@<sha> # vX.Y.Z`), treat `vX.Y.Z` as the current version. Its major version drives Step 3a.
2. If there is no version comment, resolve the SHA to a tag:

   ```bash
   gh api --paginate --slurp repos/{owner}/{repo}/tags | jq -r --arg sha "<sha>" '[.[][] | select(.commit.sha == $sha) | .name] | first // empty'
   ```

   Use the returned tag as the current version. If it returns nothing, skip the action and report "pinned SHA, version unknown" in the results table.

## Step 3 — Resolve latest versions and commit SHAs

For each unique action, determine the latest version tag within the same major version and resolve its commit SHA. If any `gh api` call fails (auth error, rate limit, repo not found), skip that action with a warning rather than aborting the entire process.

### 3a — Find the latest tag for the current major version

Extract the major version from the current ref (e.g. `@v4` → major `4`, `@v3.2.1` → major `3`). Then find the highest non-prerelease, non-draft release whose tag matches the same major version, sorted by version number:

```bash
gh api --paginate --slurp repos/{owner}/{repo}/releases | jq -r --arg m "v{major}" '[.[][] | select((.prerelease or .draft) | not) | .tag_name | select(test("^" + $m + "([.]|$)"))] | sort_by(ltrimstr("v") | split(".") | map(tonumber? // 0)) | last // empty'
```

If no matching release exists, fall back to listing tags, sorted the same way:

```bash
gh api --paginate --slurp repos/{owner}/{repo}/tags | jq -r --arg m "v{major}" '[.[][] | .name | select(test("^" + $m + "([.]|$)"))] | sort_by(ltrimstr("v") | split(".") | map(tonumber? // 0)) | last // empty'
```

If both return empty, skip the action and report "no matching releases found" in the results table.

### 3b — Resolve the tag to a commit SHA

Fetch the git ref and check its object type in a single call:

```bash
gh api repos/{owner}/{repo}/git/ref/tags/{tag} --jq '.object | "\(.type) \(.sha)"'
```

If the type is `commit`, use the SHA directly. If the type is `tag` (annotated tag), dereference it:

```bash
gh api repos/{owner}/{repo}/git/tags/{sha} --jq '.object.sha'
```

## Step 4 — Present proposed changes

Show the user a table of proposed updates before applying anything. Exclude an action only when its current pinned SHA equals the newly resolved SHA (for tag refs like `@v4`, always propose pinning).

| Workflow file | Action | Current ref | New pinned ref |
|---|---|---|---|

Ask the user to confirm before proceeding. If the user wants to skip specific actions, respect that.

## Step 5 — Apply updates

For each confirmed action reference, update the `uses:` line to the pinned format with a tag comment for readability:

```yaml
# Before
uses: actions/checkout@v4

# After
uses: actions/checkout@<full-sha> # v4.2.2
```

The comment after the SHA shows the tag name so humans can tell which version is pinned at a glance.

Do not commit or push changes unless also asked to do so.

From lucaspimentel/agent-skills, MIT.

More from lucaspimentel/agent-skills