Notify for archived repositories

[YassinEldeeb]

Tell us more.

Recently, https://github.com/actions-rs/toolchain got archived. This uses many other dependencies which will then break with time. And It'd be great if we'd have received a notification about that happening instead of us randomly finding out about the archive.

[secustor]

What kind of notification would you have expected?

A warning on the dashboard?

[rarkins]

An archived GitHub repo dependency could be considered the same as a deprecated npm dependency.

[YassinEldeeb]

Yes, exactly. I agree

[johndefensepoint]

Hi, any updates on this? We recently ran into the same situation where a GitHub Action we depend on (gacts/install-hurl) was archived.

The abandonmentThreshold feature is useful for inactivity-based detection, but it doesn't cover the case where a repo is explicitly archived on GitHub. Since the GitHub API exposes the archived flag directly, it feels like a natural fit to surface this as a warning on the PR or in the Dependency Dashboard.

Would be great to have this as a feature.

Thank you.

[jamietanna]

This is something that may come out of #42460 (at a minimum) and there may be other Enrichment modules that we can introduce to surface this

[johndefensepoint]

Thanks for the update @jamietanna