Tool Currency
Weekly backstop for scanner pin staleness.
Renovate is the primary path and stays so. This exists because Renovate can know about an update and still not land it: osv-scanner sat 46 days behind and tflint 17 days behind while both appeared on the Dependency Dashboard and the container-images group merged three times in between. Nothing in the repo noticed until someone asked.
Deliberately reports instead of failing. A tool releasing upstream is not a defect in our code, and hard-failing on it would redden main for reasons no commit caused. The report lands in a single reused issue so it is visible without adding noise.
uses: huntridge-labs/argus/.github/workflows/tool-currency.yml@1.12.2
Triggers
- Scheduled
- Manual dispatch
Permissions
| Scope | Access |
|---|---|
contents |
read |
issues |
write |
Jobs
report — Report stale scanner pins
Runs on: ubuntu-latest
Steps:
- Compare pins against adoptable upstream releases
- Upsert the report issue —
actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3