v1.0.0

First stable release of the composite action.

Usage

Minimal caller (see README for full reference):

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          token: \${{ secrets.YOUR_PAT_SECRET_NAME }}
      - uses: nerdalytics/check-action-versions@v1
        with:
          committer-name: your-bot-username
          committer-email: your-bot-email@example.com
          gh-pat: \${{ secrets.YOUR_PAT_SECRET_NAME }}

For repos with supply-chain policies that require SHA-pinned uses: refs, pin to the tagged commit SHA with the version as comment:

- uses: nerdalytics/check-action-versions@800cc33a5c20ca73557cc7358a1c1f0b91f0a90a # v1

What this action does

• Scans .github/workflows/*.yml for SHA-pinned uses: references
• Resolves each action's latest strict-semver release via the GitHub API
• When outdated, opens a tracking issue and an automated PR with the SHA/tag updates applied
• When every action is current, auto-closes the issue and any open automation PR
• Optional commit signing (SSH or GPG) via signing-method input

Inputs and secrets

See README.md for the full input reference including required/optional fields, signing setup walkthrough, and troubleshooting.