Proposal
Port the actions-audit pattern from metanorma/ci#392 to relaton/support. Quarterly cron workflow that scans this repo's .github/workflows/ + cimas-config/gh-actions/ for GitHub Actions pins (uses: <owner>/<action>@<ver>), compares against a hand-curated deprecated-actions list, and files an issue per detected deprecated pin. Surface-only — no auto-bump PRs.
Context: today's plantuml-setup-action fix (#63) sat as a dead reference for ~11 months without anyone knowing. The audit pattern is designed to catch exactly that class of drift — deprecated or removed upstream actions still pinned in workflows — before it silently degrades CI signal.
What lands (if adopted)
Three files, ~120 lines total:
-
.github/workflows/actions-audit.yml — cron trigger (1st Monday of Feb/May/Aug/Nov at 08:00 UTC — quarterly cadence right-sized to GitHub's typical 6+ month deprecation window) + workflow_dispatch for manual runs.
-
.github/scripts/audit-actions.rb — Ruby script: extracts uses: pins from YAML files under scan paths, checks against the deprecation list, creates issues per (action, version) class. Skips issue creation if an open issue with the same title exists (idempotent across quarterly runs). Supports --dry-run for local testing.
-
.github/deprecated-actions.yml — hand-curated list. Seed shape:
actions/upload-artifact@v1-3 (v3 deprecated 2024-Q4)actions/download-artifact@v1-3actions/checkout@v1-3 (Node16-based)actions/setup-node@v1-3actions/cache@v1-3actions/setup-python@v1-4actions/setup-java@v1-3
Grows as new deprecations are announced.
Design constraints
- Quarterly cadence right-sized to GitHub's typical 6+ month deprecation window (two-quarter lead time to fix).
- Scope: this repo's own workflows +
cimas-config/gh-actions/ templates. When relaton-side cimas-managed workflows get templated further, scope naturally follows.
- Surface only — no auto-bump PRs, keeps decisions with a human.
- Issue creation on finding — findings land on maintainer dashboard rather than requiring workflow-log review.
- Hand-curated deprecation list for v1 (GitHub has no stable machine-readable deprecation API for actions majors).
Reference implementation
See metanorma/ci#392 for the source implementation on metanorma-org's parallel CI infrastructure repo. All three files are portable near-verbatim; the deprecated-actions.yml seed can be trimmed to the actions relaton actually uses.
Adoption path
Happy to open a PR against this repo porting the three files if useful. Alternatively, if you'd rather draft it yourself with your own scope tuning, the reference PR above has everything needed to lift-and-shift.
🤖
Proposal
Port the
actions-auditpattern frommetanorma/ci#392torelaton/support. Quarterly cron workflow that scans this repo's.github/workflows/+cimas-config/gh-actions/for GitHub Actions pins (uses: <owner>/<action>@<ver>), compares against a hand-curated deprecated-actions list, and files an issue per detected deprecated pin. Surface-only — no auto-bump PRs.Context: today's plantuml-setup-action fix (#63) sat as a dead reference for ~11 months without anyone knowing. The audit pattern is designed to catch exactly that class of drift — deprecated or removed upstream actions still pinned in workflows — before it silently degrades CI signal.
What lands (if adopted)
Three files, ~120 lines total:
.github/workflows/actions-audit.yml— cron trigger (1st Monday of Feb/May/Aug/Nov at 08:00 UTC — quarterly cadence right-sized to GitHub's typical 6+ month deprecation window) +workflow_dispatchfor manual runs..github/scripts/audit-actions.rb— Ruby script: extractsuses:pins from YAML files under scan paths, checks against the deprecation list, creates issues per (action, version) class. Skips issue creation if an open issue with the same title exists (idempotent across quarterly runs). Supports--dry-runfor local testing..github/deprecated-actions.yml— hand-curated list. Seed shape:actions/upload-artifact@v1-3(v3 deprecated 2024-Q4)actions/download-artifact@v1-3actions/checkout@v1-3(Node16-based)actions/setup-node@v1-3actions/cache@v1-3actions/setup-python@v1-4actions/setup-java@v1-3Grows as new deprecations are announced.
Design constraints
cimas-config/gh-actions/templates. When relaton-side cimas-managed workflows get templated further, scope naturally follows.Reference implementation
See
metanorma/ci#392for the source implementation on metanorma-org's parallel CI infrastructure repo. All three files are portable near-verbatim; the deprecated-actions.yml seed can be trimmed to the actions relaton actually uses.Adoption path
Happy to open a PR against this repo porting the three files if useful. Alternatively, if you'd rather draft it yourself with your own scope tuning, the reference PR above has everything needed to lift-and-shift.
🤖