gh-action-pulse

gh-action-pulse is a utility designed to monitor and analyze the health of GitHub Actions dependencies within a repository. It scans your workflow and action definition files to identify which actions are being used and updates them to the last existing tag using (./rules.md)

Key Features

• Automatic Scanning: Detects uses: statements across .github/workflows and .github/actions.
• Reference Identification: Determines if an action is pinned to a specific commit SHA, a tag, or a branch.
• Update Recommendations: Queries the GitHub API to compare your current references against the latest stable semantic version (SemVer) tags.
• Metadata Insights: Retrieves commit dates and reference types to help evaluate the "freshness" of your CI/CD dependencies.

Setup

The tool interacts with the GitHub API and requires a GitHub Personal Access Token.

export GITHUB_TOKEN=your_github_token_here

If you haven't one, there's a fallback which will create a token using gh command

You will need python >= 3.14 to make this program works correctly.

Local Installation

uv tool install . --force --reinstall

Installation from last pypi release

Using uv

uv tool install gh-action-pulse

Using pipx

pipx install gh-action-pulse

Roadmap

Randoms items

• Maybe Separate unit tests with appropriate workflow (pytest) if checks takes times
• Add E2E tests with appropriate workflow (pytest and/or bats)
• Be able to check for nodejs version in upstream repo
• Be able to raise some warnings if there's no recent upstream tag within x days
• Maybe configuration file with some ignore parameters or specific rules for some workflows (needs thinking)
• Check eventual redirection of action to update to new URL (is there an example of this ?)
• Check if github repo of actions is not in readonly mode (sample: https://github.com/google-github-actions/release-please-action)
• Change to versioned version of tools in mise.toml when near stable version (could depend on tools)

CONTRIBUTING

• Feel free to contribute ;-)

Jean-Yves