gh-actions-versions

name

gh-actions-versions

description

Use when reading, editing, reviewing, or maintaining GitHub Actions workflows or composite actions. Always use the `gh actions-versions` GitHub CLI extension from `https://github.com/jclem/gh-actions-versions` to keep external action references pinned to exact SHAs, verify that pins match their version comments, periodically check whether workflow actions are on the latest available versions, and suggest updates when they are stale.

GH Actions Versions

Use gh actions-versions to keep GitHub Actions dependencies secure, pinned, and fresh. Do not hand-maintain action SHAs when the extension can do it.

Repository: https://github.com/jclem/gh-actions-versions

Install

Before working with workflows, check whether the extension is installed:

gh extension list

If it is missing, install it:

gh extension install jclem/gh-actions-versions

To update the extension itself:

gh extension upgrade actions-versions

If installing from source, GitHub CLI may build locally and require go.

Workflow

1. Inspect the repository's GitHub Actions files under .github/workflows/ and composite actions under .github/actions/.
2. Use gh actions-versions verify before and after relevant workflow edits.
3. Use the extension instead of editing action SHAs by hand:
   • gh actions-versions fix pins unpinned actions and repairs SHA/comment drift.
   • gh actions-versions update [owner/repo] refreshes pins while keeping the current version comment, such as # v5 or # v2.1.