v0.4.1 — cvss-suite input deprecated

v0.4.1 (2026-09-07)

• cvss-suite input deprecated. still_active 3.1.0 declares cvss-suite as a dependency, so on version: latest the input does nothing and emits a warning asking you to remove it. It still installs the gem for a pinned still_active 3.0.x. (#10)

Full Changelog: v0.4.0...v0.4.1

v0.4.0 — still_active 3.0 inputs

Catches the action up to still_active 3.0.0, released today.

New inputs

input	what it does
sbom	Audit a CycloneDX SBOM cross-ecosystem (npm, PyPI, Cargo, Go, Maven, NuGet) instead of a Gemfile
fail-if-critical	Exit 1 on critical/archived activity only, ignoring the stale/warning band
fail-if-deprecated	Exit 1 when a dependency's maintainer has declared it deprecated
fail-if-poison	Exit 1 on a dormant package capping a dependency below its latest major
fail-if-language-ceiling	Exit 1 on a pin that strands you on an EOL runtime
ecosystems-email	Join the ecosyste.ms polite pool for tokenless runs

All of these previously needed extra-args. fail-if-critical had never been exposed at all.

sbom + cyclonedx now produces an enriched SBOM

The input, re-annotated with still_active's maintenance signals as still_active:-namespaced component properties and the advisories as CycloneDX vulnerabilities, so it can be fed to Dependency-Track. Every component keeps the PURL it arrived with, so whatever matched your input matches the output.

Setting two output modes no longer fails silently

sarif and cyclonedx together used to drop one with no message, no file and a green build. The action now says which mode it is using and which it is ignoring.

Heads-up for anyone on the default

version defaults to latest, which now resolves to still_active 3.0.0. A previously-green run can go red: fail-if-vulnerable now fails closed on unscored advisories, and tokenless runs resolve real repository signals instead of degrading to unknown. See Upgrading to 3.0. Pin version: to upgrade deliberately.

v0.2.0 — alternatives input

Tracks still_active and exposes its newer flags as first-class inputs.

Added since v0.1.0

• alternatives — surface maintained Ruby Toolbox replacement leads for archived/critical gems (still_active ≥ 1.6.0).
• bundler-audit — dual-source vulnerabilities, merging deps.dev with ruby-advisory-db (still_active ≥ 1.5.0).
• cyclonedx / cyclonedx-version — emit a CycloneDX SBOM to a path or stdout (still_active ≥ 1.5.0).

Each input is covered by a self-test job against a fixture. The floating @v0 tag now points here.

v0.1.0 — initial release

Initial release of still_active-action — a composite GitHub Action wrapping the still_active gem (1.4.1+).

Usage

- uses: SeanLF/still_active-action@v0
  with:
    github-token: \${{ github.token }}
    fail-if-warning: 'true'
    fail-if-vulnerable: 'high'
    sarif: still_active.sarif.json
- uses: github/codeql-action/upload-sarif@v3
  if: always()
  with:
    sarif_file: still_active.sarif.json

See README for all inputs/outputs.

Pinning

• Convenience: @v0 (this floating tag is updated on non-breaking releases)
• Strict supply-chain: pin to the SHA of v0.1.0 and let Dependabot track it