v1.1.0

🛡️ New command: gha policy

By default any action by any author may run in your repo. gha policy generates the tightest allowed-actions policy that keeps your workflows running and compares it with the repo's current settings:

• Actions under actions/* and github/* fold into the policy's GitHub-owned switch; every other action becomes an owner/repo@* pattern — so gha update version bumps never require a policy change, while unvetted actions stay blocked.
• When an allowlist is already in force, the output diffs it against your workflows (+ used but not allowed, - allowed but unused).
• Previews by default; gha policy --yes applies the policy. Applying also enables GitHub's require SHA pinning enforcement — the platform-level counterpart to gha pin — once every local ref is pinned (--no-require-pin opts out).
• --json for machine-readable output, --repo to target another repo's settings.

📊 Billable minutes in gha stats

• New BILLABLE column shows each workflow's GitHub-hosted runner minutes for the current billing cycle (private repos; hidden when GitHub reports no billable usage).

• Organizations on GitHub's enhanced billing platform no longer get per-workflow billing data from the API — there, gha stats falls back to a repo-level month-to-date summary by runner SKU, including the net USD charge:

  Billable 2026-07 (repo total): 23h 57m — Actions Linux 19h 2m · Actions Linux 4-core 4h 55m · $6.83 net
  

• Both surfaces are included in --json output.

⬆️ gha update shows release age

Each update candidate now shows how long ago the newer version was released, so you can tell a day-old release from a battle-tested one at a glance:

actions/checkout  v3 → v7.0.0 (released 16d ago)

Full Changelog: v1.0.2...v1.1.0

Initial release

Changelog

• 91fac50 Add pin CI gate, list filters, and Enterprise host support
• a7a29e7 Initial commit