v0.3.0

What's new

• Add --pin to upgrade action references to full 40-character commit SHAs with exact release version comments.
• Automatically upgrade existing SHA pins whose comments begin with a stable semver version, preserving pins, surrounding comments, and YAML formatting.
• Select the highest eligible stable exact release for pins, honor --cooldown-days without downgrading, and resolve lightweight and annotated tags to commits.

Bare SHA pins remain skipped. Existing exact-version pins advance only to newer releases; repointing the same tag does not refresh a pin.

Maintenance

• Update golang.org/x/term and golang.org/x/sys. Building from source now requires Go 1.26 or newer.
• Add an MIT license, security policy, Dependabot configuration, and CI concurrency controls.

Changes

• feat: pin actions to exact release commits (#13)
• chore(deps): bump golang.org/x/term from 0.43.0 to 0.46.0 (#12)
• chore: add project community baseline (#11)

Full changelog: v0.2.3...v0.3.0

v0.2.3

What's Changed

• fix: publish canonical Go module path by @qartik in #10

Full Changelog: v0.2.2...v0.2.3

v0.2.2

What's Changed

• feat: add opt-in composite action scanning by @qartik in #6
• ci: add vet and race detector checks by @qartik in #8
• fix: add opt-in GitHub TLS 1.2 compatibility by @qartik in #9

Full Changelog: v0.2.1...v0.2.2

v0.2.1

What's Changed

• feat: add action update cooldown by @qartik in #2
• feat: improve stable action resolution by @qartik in #4
• fix: report tag-driven release versions by @qartik in #5

Note: Made an accidental immutable release for v0.2.0 that failed to upload release assets. v0.2.1 is same as v0.2.0.

Full Changelog: v0.1.0...v0.2.1

v0.1.0

First release of actupdate, a CLI for updating GitHub Action references in workflow YAML files to the latest stable major version.

Highlights

• Scans .github/workflows/*.yml and .github/workflows/*.yaml
• Verifies candidate updates against live GitHub tags before rewriting files
• Prefers moving major tags like v6 when they exist
• Falls back to the latest verified stable exact tag when a repo does not publish moving major tags
• Skips local actions, Docker references, SHA pins, branch refs, and other non-semver refs
• Prints a grouped update plan before applying changes
• Supports colorized terminal output
• Defaults the confirmation prompt to yes on Enter

Usage

actupdate
actupdate --yes
actupdate --repo /path/to/repo
actupdate version

Assets

This release includes binaries for:

• linux/amd64
• linux/arm64
• darwin/arm64

Notes

• v0.1.0 only updates to the latest stable major
• Same-major patch or minor bumps are intentionally not applied
• If any candidate update cannot be verified, the tool aborts without rewriting files

---

Full Changelog: https://github.com/qartik/actupdate/commits/v0.1.0