// Update all GitHub Actions workflow dependencies (uses: owner/action@vX) to their latest released versions. Fetches current releases from GitHub, updates all workflow YAML files to use SHA pinning with version comments, and commits.
| name | update-github-actions |
| description | Update all GitHub Actions workflow dependencies (uses: owner/action@vX) to their latest released versions. Fetches current releases from GitHub, updates all workflow YAML files to use SHA pinning with version comments, and commits. |
Scan all .github/workflows/*.yml files, find every uses: reference, resolve the latest release for each action, and update in place. All actions are migrated to SHA pinning with a version comment (e.g. @abc123 # v4.1.0) for supply-chain security.
git status. If there are uncommitted changes, stop and ask the user how to proceed.git switch -c update-github-actions.Find all workflow files:
find .github/workflows -name '*.yml' -o -name '*.yaml'
Extract every uses: line. Each reference has one of these forms:
uses: owner/repo@vX.Y.Z — pinned to a semver taguses: owner/repo@vX — pinned to a major-version taguses: owner/repo@<sha> # vX.Y.Z — already SHA-pinned with version commentuses: owner/repo@<sha> — SHA-pinned with no comment (treat as unknown version)uses: ./.github/actions/local — local action (skip)Deduplicate the list. For each unique owner/repo reference, record the current version string.
For each owner/repo, fetch the latest release from GitHub:
https://api.github.com/repos/{owner}/{repo}/releases/latest
If the action does not publish GitHub Releases, fall back to the latest tag:
https://api.github.com/repos/{owner}/{repo}/tags
Record the latest version tag (e.g. v4.1.0).
For every action (regardless of how it is currently pinned), fetch the commit SHA for the latest release tag:
https://api.github.com/repos/{owner}/{repo}/git/ref/tags/{latest-tag}
If the tag is an annotated tag (type tag), follow the object.url to get the underlying commit SHA. If it is a lightweight tag (type commit), use the SHA directly.
The target format for every action reference is:
uses: owner/repo@<full-commit-sha> # vX.Y.Z
For each reference, compare the current state to the target SHA-pinned form:
@vX.Y.Z → migrate to @<sha> # vX'.Y'.Z'@vX → migrate to @<sha> # vX'.Y'.Z'@<sha> # vX.Y.Z → update SHA and version tag to latest@<sha> with no comment → update to @<sha> # vX'.Y'.Z' using the resolved latest releaseReport any major-version bumps separately — these may have breaking changes.
For each workflow file, replace every action reference with its SHA-pinned form using exact string replacement.
Examples:
# before (semver tag)
uses: actions/checkout@v3
# after
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.1.0
# before (major-version tag)
uses: actions/setup-go@v4
# after
uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
# before (SHA-pinned, stale)
uses: actions/download-artifact@9782bd6a9848b53b110e712e20e42d89988822b7 # v3.0.1
# after
uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.1.0
Print a table of all changes:
| Action | Old version | New version | Major bump? |
|---|
If any major-version bumps are present, note that the action's changelog should be reviewed for breaking changes and provide the GitHub releases URL.
Stage only .github/workflows/ files.
Commit:
chore(ci): update GitHub Actions to latest versions
<paste summary table>
@<sha> # vTag format — this is the target state regardless of how the action was previously pinned.-beta, -rc), skip it and use the latest stable release instead.github/codeql-action) release very frequently — confirm the version looks sane before committing.
Analyze a GitHub pull request for risk level and generate concrete QA recommendations. Accepts a PR URL or "owner/repo#number" reference. Uses `gh` CLI to fetch the diff and metadata, computes blast radius, scores six risk dimensions, and returns a structured JSON risk assessment. Use when the user invokes /qa-analysis:qa-analysis with a GitHub PR URL or reference, or asks for a PR risk assessment, QA recommendations, or "what should I test?" for a given pull request.
Add an MCP (Model Context Protocol) server to a Mattermost plugin so the Agents plugin can call its tools. Use when implementing cross-plugin MCP, exposing AI tools from a Mattermost plugin to the Agents plugin, or wiring up the `pluginmcp` helper from mattermost-plugin-agents.
Create a new Mattermost plugin from the starter template in the current directory. Use when creating a new plugin from scratch, scaffolding a Mattermost plugin, or bootstrapping a plugin project.
Orchestrates test-driven fixes for Mattermost security tickets (Jira/Atlassian) with a Staff Security Engineer mindset: failing secure-behavior tests first, then implementation, then security review and edge-case loops, then opening a non-draft PR that follows `.github/PULL_REQUEST_TEMPLATE.md` when present, with a vague public description (no exploit detail). Use when the user invokes /security-fix:security-fix with a mattermost.atlassian.net browse URL, MM-* security work, backend permission or authorization bugs, or asks for this security TDD workflow.
Investigate production issues, query logs and metrics, and explore dashboards on the Mattermost Grafana instance at grafana.internal.mattermost.com.
Update all direct Go module dependencies to their latest versions, tidy the module graph, verify tests pass, and commit the result. Use when you want to bump deps, address CVEs, or do routine dependency maintenance.