v1.1.0

Runs lockrot 0.13.0. Read the first two entries if your workflow passes args or publishes the report outside the repository. Inputs and outputs are unchanged. The full list is in the 0.13.0 release notes.

Changed

• Breaking: a misspelt option or a missing value in args, or an invalid LOCKROT_FAIL_ON or LOCKROT_TARGET_PHP in the job's environment, fails the step with exit 2 instead of 1, so exit-code no longer reads it as a finding. Action: fix the option or the variable.
• Breaking: format: json and format: html reports carry run.root_package, the name in composer.json, even when extra.lockrot.project renames the project. Action: if you publish the report outside the repository and the name must stay private, remove it first.
• A report quotes no credential and no path of the runner: URLs lose their login and token, and a path keeps its last segment. Reports written by earlier versions could carry both.
• With COMPOSER set in the job's environment, lockrot reads that manifest and its lock, as Composer does.
• An extra.lockrot key lockrot does not read gets a warning line in the log, naming the key it was probably meant to be.
• format: html is the lockrot-report 0.13.0 page.
• format: json gains fields that state lockrot's decisions, among them gate (whether the run fails), priority_basis and origin; the JSON schemas list them all.

v1.0.13

Runs lockrot 0.12.0, pinned by sha256 in lockrot.env as always.

The format: html page is new. It is built in its own repository now, somework/lockrot-report, and lockrot vendors a release of it: same report, same keys, same address format, so a link to a filtered view or an open package still points where it did. The page carries its own Content-Security-Policy that pins its one script and one stylesheet by hash and allows no connection of any kind. On a phone the findings come first. A bad escape in the address no longer blanks the page, the theme button is right the first time under a dark OS setting, and a release-branch label in the timeline wraps instead of being cut short.

Nothing else in the run changes: verdicts, priorities, fail-on, annotations and the PR comment are the same as with 0.11.0. See the lockrot 0.12.0 release notes.

v1.0.12

Runs lockrot 0.11.0, pinned by sha256 in lockrot.env as always.

Adds fail-on: unchecked — fail the step when a check a verdict rests on did not run, rather than pass over an unasked question. The case it is for is the workflow that never passed github-token through: anonymously GitHub allows 60 requests an hour, so lockrot asks about the packages that already look stale on release age and no others, and a repository archived a week after its last release is never seen. That run reports ok and exits 0, exactly like a run that checked everything. With this threshold it exits 1 and the evidence names each missing check and the signals it blocked. It is neither a verdict nor a priority, so it composes with neither — reach for it when the question is "did this run actually check?" rather than "what did it find?". Credentials take away the repository-activity reasons and only those: a package whose newest releases are dated by a commit their tags share still carries the signal.

left-behind now suggests a branch the project can install. Until now S8 named the newest releasing branch and wrote the constraint that follows it whatever PHP that branch requires — a project on PHP 7.4 was told require ^3.12 for a branch needing 8.1, a line it cannot write. The suggestion is now held to the project's own require.php and the target PHP, and where no releasing branch is within reach it says so and suggests nothing. A workflow whose annotations or PR comment are read by a person sees different require ^X lines, and fewer of them; the verdict itself is unchanged, so fail-on: left-behind and fail-on: high fail on the same locks as before.

One number for how far behind the lock is: libyears, the years between each installed release and its package's newest stable one, summed. It prints in the footer of every format, rides in --format=json per finding and as a block, and shows in the HTML page. It is laid over the verdicts and enters no fail-on, no priority and no baseline, so nothing in an existing workflow changes because of it. A package whose installed tag is dated only by a commit its tags share is left unmeasured rather than measured from that commit's date — on a lock full of symfony/polyfill-* that is several packages counted as unknown instead of as a year or two behind.

abandoned also says whether there is somewhere to go: Packagist's replacement field is free text, so an annotation could read migrate to Symfony. It is now printed only where it names a real package. See the lockrot 0.11.0 release notes and CHANGELOG.md.

v1.0.11

Adds format: html: the whole run as one self-contained page, made to be uploaded as an artifact. It carries the report, the release branches behind every finding, the advisories and the baseline comparison in a single file that opens from the downloaded artifact with no server and nothing fetched from anywhere, and the filters and the open package live in the URL, so a link points at what the sender was looking at — it is the format for the person who did not run it, a reviewer or whoever picks the ticket up a week later. The report file is named .html, so the artifact opens as a page rather than as text; all: true puts every checked package in it at roughly 4 KB each, and without it a 100-package lock lands around 250 KB. See the recipe.

Runs lockrot 0.10.0. A repository URL no longer carries its credentials into a report. A private Composer source is routinely configured with a token in the URL — https://gitlab-ci-token:$CI_JOB_TOKEN@… is how GitLab CI hands a job access to one, and Bitbucket app passwords take the same shape — and Composer keeps it in the lock because it has to fetch with it. lockrot 0.8.0 and 0.9.0 printed that value verbatim in --explain, so a workflow that passed --explain through args put a working token wherever the report went: the step log, the job summary, the uploaded file. Every repository URL lockrot prints now has its userinfo removed and its host kept, and a run that never asked for an explanation was not affected.

The JSON this action uploads also says what the run was told to do. --format=json now opens with a run block naming the project — from its own name in composer.json, or extra.lockrot.project where that is not the name to publish — along with the target PHP, the thresholds, the fail-on, the name of the lock and the verdicts the run counted as findings. Until now a report named the target PHP in one place only, inside an S5 signal, so a run where S5 never fired left no record of what it aimed at. Every finding also carries baseline: known, new or worsened, with the verdict the baseline accepted. Both are optional under the same schema number, so a step that reads the report keeps working — see the lockrot 0.10.0 release notes. See CHANGELOG.md.

v1.0.10

Runs lockrot 0.9.0. Packages split out of a monorepo are measured again: 0.8.0 read a tag sharing its commit with two others as undated, which killed a false left-behind but also silenced a branch that really had stopped, and the monorepo's own tag for the same version now supplies the date. A lock on illuminate/contracts v5.8.36 reads branch 5.x last released 2020-08-18 (6.1 years ago, dated by laravel/framework) where 0.8.0 said nothing, so a Laravel, Symfony or CakePHP lock that passed under fail-on: left-behind or fail-on: high can start failing; Laravel's late security tags on 6.x, 7.x and 8.x keep those branches reading as current under the default thresholds. The JSON this action uploads is a published document now: --format=json opens with a $schema key naming report-1.json, so a later step can validate it with any draft-04 validator, and S8 and S2 gain dated_by naming the monorepo that dated the branch. Under one number a document only ever gains fields and lockrot.schema stays 1, so a step that reads the report keeps working — see the lockrot 0.9.0 release notes. The action still pins the PHAR by sha256 in lockrot.env; nothing changes in how it runs. See CHANGELOG.md.

v1.0.9

Runs lockrot 0.8.0. The false left-behind on packages split out of a monorepo (illuminate/* on a Laravel lock) is gone: a tag dated only by a commit that two or more other tags share is read as undated, so a workflow with fail-on: left-behind or fail-on: high can pass on a lock that failed before. The evidence the annotations and the PR comment carry changes with it: a direct left-behind row ends require ^8.2 to follow, an abandoned row with a named replacement and an open advisory ends no fix expected; migrate to symfony/mailer. The footer says why composer audit counts more without --dev; --format=json gains include_dev and suggested_constraint on S8, the schema number stays 1. lockrot's new --explain is a one-package question for a terminal and has no input here — see the lockrot 0.8.0 release notes. The action still pins the PHAR by sha256 in lockrot.env; nothing changes in how it runs. See CHANGELOG.md.

v1.0.8

Runs lockrot 0.7.0, which adds the left-behind verdict (a quiet release branch under a higher branch that keeps shipping) and carries security advisories on the finding, saying which release fixes each or that no fix is expected. fail-on accepts left-behind; a package that was ok, stale or old-promise can now be left-behind (base priority high), and an advisory on an abandoned, silent or left-behind package lifts its priority one step, so a workflow with fail-on: high or fail-on: critical can start failing on a lock that passed before — see the lockrot 0.7.0 release notes. The action still pins the PHAR by sha256 in lockrot.env; nothing changes in how it runs. See CHANGELOG.md.

v1.0.7

Runs lockrot 0.6.1, which restores phive install somework/lockrot (the self-update signature asset is lockrot.phar.sig.json now). The action pins the PHAR by sha256 in lockrot.env; nothing changes in how it runs. See CHANGELOG.md.

v1.0.6

Runs lockrot 0.6.0: a reproducibly built PHAR whose self-update verifies each release's signature with a key built into the archive. The action still pins the PHAR by sha256 in lockrot.env; nothing changes in how it runs. See CHANGELOG.md.

v1.0.5

Runs lockrot 0.5.0 — the first GPG-signed and GitHub-attested PHAR release, and phpstan/phpstan is no longer reported abandoned. The action still pins the PHAR by sha256 in lockrot.env; nothing changes in how it runs. See https://github.com/somework/lockrot/releases/tag/v0.5.0.