• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Odin Scan GitHub Action is an AI-powered tool that automatically scans smart contract code for vulnerabilities on CosmWasm, Solana, and EVM platforms. It integrates with GitHub Code Scanning to provide native security alerts and inline annotations in pull requests. The action supports multi-platform detection and configurable thresholds for severity levels, allowing developers to catch vulnerabilities early in the development process.

What’s Changed

🎉 Initial Release

AI-powered smart contract security analysis, now integrated directly into your GitHub workflow.

✨ Features

Multi-Platform Support

• CosmWasm - Rust-based smart contracts for Cosmos SDK
• Solana (SVM) - Anchor and native Solana programs
• EVM - Solidity and Vyper contracts
• Auto-detection - Automatically identifies platform from your repo

GitHub Integration

• Code Scanning - SARIF upload for native security alerts in the Security tab
• PR Comments - Severity summary and top findings posted directly on pull requests
• Inline Annotations - Critical/high findings appear as errors, medium/low as warnings on diffs
• Artifact Upload - Full JSON report available as workflow artifact

Customization

• Severity Thresholds - Fail builds at critical, high, medium, or low severity
• Platform Override - Force specific platform detection when auto-detect isn’t enough
• Timeout Control - Configurable analysis timeout (default: 30 minutes)
• Flexible Triggers - Run on push, PR, schedule, or manual dispatch

🚀 Quick Start

name: Security Scan
'on':
  pull_request:
    branches:
      - main
jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: odin-scan/odin-scan-action@v1
        with:
          api-key: '${{ secrets.ODIN_SCAN_API_KEY }}'

📋 Requirements

• Odin Scan Pro subscription - Required for API access
• API Key - Generate at https://odinscan.ai/dashboard/settings
• GitHub Permissions - contents: read, security-events: write (for SARIF), pull-requests: write (for comments)

🔧 Configuration

All Inputs

| ┌────────────────────┬─────────────────────┬──────────────────────────────────────────────┐ | | │ Input │ Default │ Description │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ api-key │ Required │ Your Odin Scan API key (odin_sk_*) │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ platform │ auto │ Target platform: auto, cosmwasm, solana, evm │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ severity-threshold │ high │ Fail at: critical, high, medium, low, none │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ fail-on-findings │ true │ Whether to fail workflow on findings │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ comment-on-pr │ true │ Post summary comment on PRs │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ upload-sarif │ true │ Upload SARIF to Code Scanning │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ upload-artifact │ true │ Upload full report as artifact │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ timeout │ 1800 │ Max analysis wait time (seconds) │ | | ├────────────────────┼─────────────────────┼──────────────────────────────────────────────┤ | | │ github-token │ ${{ github.token }} │ Token for PR comments and SARIF │ | | └────────────────────┴─────────────────────┴──────────────────────────────────────────────┘ |

All Outputs

• analysis-id - Unique analysis identifier
• status - Analysis status (completed, failed)
• total-findings - Total number of findings
• critical-count, high-count, medium-count, low-count - Counts by severity
• report-url - Link to full report on Odin Scan
• sarif-file - Path to generated SARIF file

📝 Example Workflows

Basic (Auto-detect)

  - uses: odin-scan/odin-scan-action@v1
    with:
      api-key: ${{ secrets.ODIN_SCAN_API_KEY }}

EVM with Medium Threshold

  - uses: odin-scan/odin-scan-action@v1
    with:
      api-key: ${{ secrets.ODIN_SCAN_API_KEY }}
      platform: evm
      severity-threshold: medium

Only on Solidity Changes

on:
  pull_request:
    paths:
      - '**.sol'
      - foundry.toml

🔒 Security & Privacy

• All API communication over HTTPS (TLS 1.2+)
• API keys automatically masked in logs
• No data stored by the action (stateless)
• See https://github.com/Odin-Scan/odin-scan-action/blob/main/PRIVACY.md for details

📖 Documentation

• Action README - https://github.com/Odin-Scan/odin-scan-action
• Odin Scan Docs - https://docs.odinscan.ai
• Get API Key - https://app.odinscan.ai/settings

🐛 Known Limitations

• Private repos - Requires github-token with repo access
• Large repos - May need increased timeout for complex codebases
• Code Scanning - Requires GitHub Advanced Security on private repos

🙏 Support

• Issues - https://github.com/Odin-Scan/odin-scan-action/issues
• Email - support@odinscan.ai
• Docs - https://docs.odinscan.ai

Full Changelog: https://github.com/Odin-Scan/odin-scan-action/commits/v1

• This action is used across all versions by 5 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the CI process for Nix flake repos by running checks and building specific attributes. It supports installing Nix and restoring a cache on hosted runners, and it can build hosts, packages, or dev shells as specified in the flake. The action is designed to be used within a job step and can run before or after other tasks.

What’s Changed

Fixed

A truncated Nix archive download no longer fails the job. nix-quick-install-action pipes its download straight into tar, so a short body cannot be retried: curl --retry is powerless once the bytes have reached tar. The job died with zstd: unexpected end of file, and the reported failure named the caller’s job — gofmt, lint — rather than the download.

Both actions now fetch the archive to a file first and hand the verified copy to nix-quick-install-action through its nix_archives_url input:

• Three bounded attempts with a growing wait, and an integrity check on each. A body that arrives short but well-formed at the transfer level is the case only the integrity check can catch; it drives a retry, not a job failure.
• A download that never arrives intact fails with a message naming the URL, not the extraction.
• Only a 404 skips the retry — it means nix-version is not a version the pinned release ships. A 5xx or an expired asset redirect is retried.
• --speed-limit/--speed-time bound a stalled body, so the retry is bounded in wall time and not only in attempts.

Reported downstream as InoBram/inobramxd#488.

Added

• nix-version input, on both nix-actions and update-flake. Default 2.29.2, which tracks the pinned nix-quick-install-action release’s own default. It must be a version that release ships.

Tests

tests/prefetch-nix-archive.test.sh — 26 assertions against a local server that reproduces each failure mode. It installs no Nix, so it still reports when the Nix install itself is broken.

Upgrading

No caller change is required. @v1 now points at this release.

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the validation, build, and publication process of an Otzaria plugin. It checks for specific errors during package creation and compilation, builds the .otzplugin file, and publishes it to Otzaria’s store automatically when pushing changes to the main branch. The action can also perform a full check on pull requests without requiring secrets but still validates the plugin.

What’s Changed

מה חדש

חריג פס הכותרת ב-font-size. ולידציית העיצוב פסלה כל font-size בערך px קבוע, בעוד ש-DESIGN_GUIDE מחייב דווקא גדלים קשיחים בפס הכותרת — כדי שהפס לא יתנפח עם גופן הקריאה שהמשתמש בחר. תוסף שמימש את המפרט כלשונו נחסם מפרסום. כעת החריג נאכף לפי שם הסלקטור (topbar / top-bar, כבדוגמת המפרט), וכל שאר הכללים ממשיכים להיפסל. הודעת ההפרה מפנה לחריג.

סנכרון מול ה-SDK: calendar.getCities (הרשאת calendar.read, מגרסה 0.9.97) והאירוע calendar.city_changed.

בדיקות: 32 עוברות — כולל px מותר בפס, נפסל מחוצה לו, והחריג אינו זולג לכלל הבא.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the security testing of web applications by leveraging AI coding agents to detect potential vulnerabilities such as OS command injection. It provides detailed explanations and remediation proposals, helping users understand how to secure their projects and ensure that changes do not introduce new risks. The action supports a wide range of programming languages and codebases, including JavaScript/TypeScript and Python Web code.

What’s Changed

v0.4.0 release evidence

Scope, audit, harden, and retest web projects with AI coding agents and reproducible evidence.

Web App Security Skill v0.4.0 is the evidence-integrity and useful-detection release. It keeps the agent-guided hardening methodology while making narrow automated results harder to overstate.

Release identity

• Version/tag: v0.4.0
• Source identity: the commit peeled from the SSH-signed annotated tag; the exact 40-character SHA is also recorded in web-app-security-skill-0.4.0.release.json and the provenance attestation.
• Runtime matrix: Node.js 22 and 24 on Ubuntu and macOS; Bash 3.2 remains covered on macOS.
• External adapters: Gitleaks 8.30.1 and OSV-Scanner 2.5.0, installed and pinned by the caller.

The Markdown file is part of the source commit it describes, so it does not embed a fabricated self-referential commit SHA. Verify the exact published identity with the signed tag and manifest.

Evidence model and migration

Report v2 binds findings to subject, scope, rule revision, adapter and ruleset identity. Per-rule coverage records discovered, eligible, scanned, excluded, skipped, truncated and failed work. A missing or incomplete check is explicit unknown/unavailable evidence and cannot establish fixed.

Historical v1 reports remain readable but are never silently comparable. migrate-report records their original SHA-256 and explicit user binding as non-comparable lineage; a new persisted v2 audit is required before a later retest can prove a fix. Moved or cloned projects require explicit rebind acknowledgement rather than path or repository-name inference. See docs/report-v2-migration.md.

Detection and reporting changes

• Built-in source checks remain deliberately narrow: lockfile absence, environment-named files, public Node inspector bindings and common production source-map settings.
• Gitleaks checks committed history and the working tree. OSV-Scanner checks supported recorded lockfiles and may query the public OSV advisory service. Neither adapter is downloaded by the product and project dependencies are not executed.
• Every external scanner match is suspected. Gitleaks does not prove credential validity or exposure; OSV does not prove reachability, deployed version or exploitability.
• Reports separate security_exposure, supply_chain, search_discoverability, reliability and evidence_integrity. A HIGH discoverability result is not a HIGH security vulnerability.
• JSON, Markdown, HTML, SARIF and JUnit are committed as one private atomic evidence bundle after sanitization and validation. Existing output is not overwritten.
• The composite Action keeps v0.3 crawl behavior and adds source mode. External findings require an acknowledged alert-owner policy before they can affect the configured gate.

Five-project evidence

The dated 2026-08-14 corpus ran the complete v2 source path at immutable commits without probing a hosted project or executing project dependencies.

These records demonstrate applicability, state discipline and false-positive closure. They are not labelled benchmark data and do not support a precision/recall score. OSV counts can change as its public advisory database changes. Reproduction commands and unreached surfaces are in docs/case-studies/journeys/.

Regressions fixed

• Cross-project, tampered, forged, v1 or incomplete baselines cannot manufacture a fixed result.
• Deep, large, unreadable, malformed and truncated source candidates remain visible in coverage.
• Crawler-range, sitemap and AWS permission failures become unknown evidence, never a clean result.
• Cross-domain severity is no longer combined into one security headline.
• Evidence writes are private, atomic, non-overwriting and rolled back after handled failures.
• External-tool missing/version/timeout/error/malformed paths fail closed; upstream OSV severity cannot inflate local severity.
• Duplicate Gitleaks rows are deduplicated while distinct fingerprints remain distinct; finding IDs survive sanitizer patterns that resemble numeric account identifiers.

The complete bug-to-test map is docs/regression-inventory.md.

Release verification

The release workflow runs the full gate, builds every artifact twice and compares bytes, verifies archive paths, manifest, SHA-256 list and SPDX 2.3 SBOM, then exercises an isolated v0.3.0-to-v0.4.0 upgrade plus clean install/version/start/upgrade/uninstall behavior. GitHub provenance is requested only after those checks pass. A separate consumer repository verifies both backward-compatible crawl mode and built-in source mode against the exact candidate/release commit.

Verify the published tag after release:

git -c gpg.ssh.allowedSignersFile=.github/release-signers verify-tag v0.4.0

Verify downloaded assets with SHA256SUMS, then compare the manifest source commit with git rev-parse 'v0.4.0^{}' and verify GitHub provenance. The post-publication verifier now trusts the immutable v0.4.0 asset digests, and the documented bootstrap pins and verifies that verifier before installation.

Unsupported and unknown

• This is not a general SAST/DAST scanner, authenticated pentest or automatic patching system.
• BOLA/IDOR, business logic, LLM/OAuth, database isolation and most framework-specific sinks remain agent-guided and require project context.
• No authenticated third-party deployment, production cloud account or upstream live system was actively tested for this release.
• Native Windows, PowerShell and WSL2 are unsupported because no maintained verification environment exists. Node 20 and earlier are not supported release targets.
• Release signatures, checksums and attestations establish artifact identity and build origin; they do not prove every security conclusion is correct or that an installed project is secure.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Prowler is an open-source, automated tool that helps organizations identify security risks and non-compliance issues in their cloud environments through a suite of security checks and compliance frameworks. It automates the process of scanning AWS and Azure environments to ensure compliance with industry standards and best practices, providing real-time monitoring and seamless integrations for simple, scalable, and cost-effective cloud security.

What’s Changed

✨ New features to highlight in this version

Enjoy them all now for free at https://cloud.prowler.com/

🤖 Lighthouse AI — Finding Skills

[!NOTE] This feature is available exclusively in Prowler Cloud and Prowler Private Cloud with a subscription.

Lighthouse AI now embeds a Skills menu on every finding, answering the questions an analyst actually asks. Contextual Fix produces the fix for the finding, Triage Decision judges whether it is real and closes it out when it is not, and Systemic Scope determines whether the problem is a one-off or everywhere. A free-form “Ask Lighthouse anything” prompt sits in the same menu, and each run shows its progress and offers follow-up actions such as creating a Jira issue or muting the finding.

Read more in the Lighthouse AI documentation.

☁️ Azure Management Group Onboarding

[!NOTE] This feature is available exclusively in Prowler Cloud and Prowler Private Cloud with a subscription.

Azure subscriptions no longer onboard one at a time. Choose “Add Multiple Subscriptions With Azure Management Group” in the add-provider wizard, enter the Microsoft Entra tenant ID, and authenticate once with a single tenant-wide service principal: Prowler discovers the entire management-group hierarchy under the tenant root, lets you select the subscriptions to onboard, and creates their providers with the management-group structure preserved. Azure now matches the one-step onboarding that AWS Organizations and GCP organizations already have.

Read more in the Azure Management Groups documentation.

✅ Findings Triage — Verify MANUAL Findings as PASS

[!NOTE] This feature is available exclusively in Prowler Cloud and Prowler Private Cloud with a subscription.

Checks that require human judgment report MANUAL findings. For these findings, and only for them, the triage status selector now offers Resolved: choosing it asks for the required written evidence and verifies the finding as passing. The finding then reports an effective PASS while preserving the raw MANUAL scan result, across findings, finding groups, compliance reports, and scans, with the attestation’s author, evidence, and validity always visible. Attestations expire automatically after 90 days, or as soon as a new scan reports a real failure, returning the finding to the review queue.

Read more in the Findings Triage documentation.

☁️ Prowler Cloud MCP — Organizations Management and Grouped Jira Dispatch

[!NOTE] This feature is available exclusively in Prowler Cloud and Prowler Private Cloud with a subscription.

The hosted Prowler Cloud MCP server adds eight organization tools, so an agent can onboard and manage entire cloud organizations end to end: create the organization, discover its accounts, subscriptions, and projects, apply the selection, and manage the resulting providers. The tools cover AWS Organizations, GCP organizations, and Azure tenant root management groups, and they are available to Lighthouse AI.

prowler_send_findings_to_jira also gains Cloud-only dispatch capabilities: select failed findings by check IDs against the latest completed scan, and send them in grouped mode, one Jira work item per check listing up to 50 affected resources, with per-group error reporting.

Read more in the Prowler MCP tools documentation and its Jira operations reference.

🕸️ Attack Paths — Grouped Graph with Outcome Destinations

[!NOTE] This feature is available exclusively in Prowler Cloud and Prowler Private Cloud with a subscription.

The Attack Paths graph now reads from source to destination. Resources of the same class collapse into a single expandable node with a count, clicking reveals its members, and every path terminates in an explicit outcome node naming the destination impact: code execution, privilege escalation, public exposure, or resource inventory. The per-account hub node is gone, and the clicked resource stays highlighted while its findings are expanded.

Explore the full Attack Paths query catalog at Prowler Hub.

Read more in the Attack Paths documentation.

📚 New Compliance Framework — CMMC 2.0

The Cybersecurity Maturity Model Certification (CMMC) is the certification the US Department of Defense requires from contractors and suppliers that handle federal contract data. Prowler now includes CMMC 2.0 as a universal framework with all 149 requirements defined by the CMMC Program rule (32 CFR Part 170), organized in its three levels:

• Level 1 (Foundational): 15 requirements for the basic safeguarding of Federal Contract Information, from FAR 52.204-21.
• Level 2 (Advanced): 110 requirements from NIST SP 800-171 Rev 2, protecting Controlled Unclassified Information.
• Level 3 (Expert): 24 enhanced requirements from NIST SP 800-172 for the most sensitive programs.

Requirements map to Prowler checks across AWS, Azure, GCP, Alibaba Cloud, Oracle Cloud, and Microsoft 365, so one framework reports the compliance posture of the whole estate.

Read more in the Compliance documentation.

🔍 Checks

Microsoft 365

Twenty new Entra ID checks expand the coverage of CIS Microsoft 365 Foundations Benchmark v7.0.0:

• Password protection: custom banned password list, on-premises enforcement, and lockout threshold and duration.
• Default user permissions: security group and Microsoft 365 group creation restricted, and guest invitations limited to allowed domains.
• Conditional Access: high and medium sign-in risk blocked, authentication transfer blocked, untrusted locations blocked, trusted named locations defined, sign-in frequency enforced, and token protection enforced.
• Sessions and authentication methods: idle session timeout configured, email one-time passcodes disabled, and Microsoft Authenticator context shown.
• PIM and access reviews: approval required to activate the Global Administrator and Privileged Role Administrator roles, and access reviews configured for guest users and privileged roles.

Explore all Microsoft 365 checks at Prowler Hub.

AWS

Two new checks detect hardcoded secrets:

• batch_job_definition_no_secrets scans Batch job definition environment variables and command parameters. Thanks to @praneetrajv!
• awslambda_layer_no_secrets_in_content scans Lambda layer package content. Thanks to @ganiganesh25!

Explore all AWS checks at Prowler Hub.

🙌 External Contributors

Thank you to our community contributors for this release!

• @praneetrajv: AWS batch_job_definition_no_secrets check (#12117)
• @ganiganesh25: AWS awslambda_layer_no_secrets_in_content check (#12233)
• @andoniaf: GitHub organization_repository_creation_limited now reports low severity when repository creation is limited to private or internal visibility (#12164)

UI

🚀 Added

• Manual verification workflow for MANUAL findings with evidence, effective PASS status, and expiration details (#12253)
• Surface pre-configured credential creation links in the add-provider wizard. Cloudflare exposes the User API Token template and an Account-Owned template pinned to the Cloudflare Account ID entered in the wizard, GitHub exposes the personal-repositories template and an organization-scanning template pinned to the identifier entered in the wizard (#12349)
• Attack Paths graph groups resources by class into expandable nodes and marks the query outcome as the terminal node, with the clicked resource highlighted while its findings are expanded (Prowler Cloud only) (#12381)
• Azure Management Group onboarding: add every subscription in a tenant at once (Prowler Cloud only) (#12386)
• Manage Lighthouse AI role permission in the role forms and role details, so permission to change the Lighthouse AI configuration can be granted or restricted independently of other permissions (Prowler Cloud only) (#12412)
• CMMC 2.0 universal compliance framework rendering: dedicated icon, Domain/Level requirement mapper and cross-provider catalog tile (#12414)

🐞 Fixed

• Organization discovery describes a too-deep hierarchy in each provider’s own vocabulary: AWS organizational units, Azure Management Groups, Google Cloud folders (#12386)
• View Findings on the Scans page no longer opens an empty list for users outside the UTC timezone (#12411)

API

🔄 Changed

• GET /api/v1/users/me membership relationships identify the active tenant with meta.active for JWT and API key authentication (#12388)

🐞 Fixed

• Tenant deletion no longer leaves memberships partially removed when exclusive-user cleanup fails (#12379)
• /api/v1/accounts/saml/{organization_slug}/acs/ rejects non-POST requests before SAML response processing (#12393)
• Social login derives a valid user name when identity providers omit the profile name (#12413)

SDK

🚀 Added

• batch_job_definition_no_secrets check for AWS provider, scanning Batch job definition environment variables and command parameters for hardcoded secrets (#12117)
• 7 M365 Entra checks covering CIS Microsoft 365 Foundations Benchmark v7.0.0 password protection, default user permissions, and guest invitation domain restrictions (#12153)
• 7 M365 entra checks covering CIS Microsoft 365 Foundations Benchmark v7.0.0 Conditional Access (5.2.2.x) and idle session timeout controls (#12154)
• entra_authentication_method_email_otp_disabled, entra_authentication_method_authenticator_show_context, entra_pim_global_administrator_approval_required, entra_pim_privileged_role_administrator_approval_required, entra_access_review_guest_users_configured and entra_access_review_privileged_roles_configured checks for M365 provider covering CIS Microsoft 365 Foundations Benchmark v7.0.0 authentication method, PIM approval and access review controls (#12155)
• awslambda_layer_no_secrets_in_content check for AWS provider, scanning Lambda layer package content for hardcoded secrets (#12233)
• CMMC 2.0 universal compliance framework (cmmc_2.0) with the 149 official requirements from 32 CFR Part 170 — Level 1 (15, 48 CFR 52.204-21), Level 2 (110, NIST SP 800-171 Rev 2) and Level 3 (24, NIST SP 800-172) — with AWS, Azure, GCP, Alibaba Cloud, Oracle Cloud and M365 check mappings and config guardrails (#12401)

🔄 Changed

• GitHub organization_repository_creation_limited check now reports low severity for FAIL findings when repository creation is provably limited to private/internal visibility, instead of always reporting high (#12164)

🔐 Security

• HTML report header now HTML-escapes every provider identity field across all 23 providers, closing a stored XSS in the header block (Secur0, CWE-79) that was left unaddressed by the earlier finding-row fix in #12221 (#12424)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The rsscan GitHub Action automatically detects and blocks commits and builds introducing API keys, tokens, and other machine credentials in a repository by scanning added lines. It uses local patterns to detect common credential types, providing inline annotations on pull requests to help developers identify and address security issues early. The action is suitable for use with pre-commit hooks, GitHub Actions, GitLab CI/CD, CircleCI, Docker pipelines, and various other CI tools without requiring any additional configuration or setup beyond installation.

What’s Changed

rsscan --deps

Counts the accounts that can publish into your npm dependencies.

pip install rsscan
rsscan --deps

A self-replicating npm worm does not start with malicious code. It starts with a maintainer account: an infostealer takes the publish token out of somebody’s .npmrc, and a patch version nobody reads ships four steps before there is any artifact for a scanner to analyse.

Every package security tool reads the artifact. None of them can tell you how many humans hold publish rights over your tree.

An ordinary install of Next.js, React, TypeScript, ESLint, Jest, axios, Tailwind, Prettier and dotenv:

     433  dependencies in package-lock.json
     275  distinct publisher accounts can push code into them
     126  on personal webmail (no SSO, no central revocation)
      28  role or automation addresses

Reproduce it with npm install --package-lock-only --ignore-scripts, then rsscan --deps.

What it does not do

It counts, and deliberately stops there. No screening, no verdicts, and it names nobody: the output is integers.

• Reads locally. No account, no API key, no telemetry. The only host it contacts is registry.npmjs.org.
• Unresolved packages are counted separately and never folded into the totals. A package whose publishers could not be looked up is not a package with no publishers.
• Always exits 0. There is no dependency count that constitutes a build failure, so this is a report and not a gate.

Also in this release

• --org remains opt-in and off by default.
• The module docstring no longer implies a --staged flag exists. Staged is what you get without --rev-range.

Full changelog: https://github.com/RelayShield/rsscan/compare/v0.1.3...v0.2.0

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action, “Hello world docker action,” is designed to print a greeting message either in English or with a specified name. It automates tasks such as personalizing greetings and tracking timestamps for logging purposes. Key capabilities include customizable inputs for the person to greet and an output that provides the time of greeting.

What’s Changed

• My first action is ready (5619594)
• Initial commit (2a56a2a)

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action automates Salesforce deployment, testing, quality analysis, and release management processes using the @sfdt/cli tool. It supports interactive workflows, automated release manifest generation, parallel Apex test execution with coverage enforcement, code and test quality analysis, pre-release validation checks, deployment rollback, post-deploy smoke testing, org metadata drift detection, multi-package project support, AI-powered deployment error log interpretation, PR descriptions and Slack messages, AI-generated code review, test failure analysis, changelog generation, and release notes. It also includes features like CI/CD pipeline templates, notifications, plugin architecture, and multi-channel messaging capabilities.

What’s Changed

What’s Changed

• chore: release extension v0.13.0 by @scoobydrew83 in https://github.com/scoobydrew83/sfdt/pull/336
• chore: release v0.22.2 by @scoobydrew83 in https://github.com/scoobydrew83/sfdt/pull/337

Full Changelog: https://github.com/scoobydrew83/sfdt/compare/v0.22.1...v0.22.2

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Purpose and Functionality: The CI Health Audit GitHub Action performs a heuristic static audit of GitHub Actions workflows to identify common security and reliability risks. It checks for issues like un-pinned third-party actions, self-hosted runners, excessive permissions, dangerous event interpolation, insecure curl/wget usage, and mutable container tags.

Problems Solved: The action helps prevent potential vulnerabilities in CI processes by automating a manual static code analysis of workflows. It ensures that security best practices are followed and identifies common pitfalls early on.

Key Capabilities: - Scans workflow YAML files locally. - Publishes a summary visible in the GitHub Job Summary page. - Allows setting a fail-on threshold for severity levels. - Provides focused remediation suggestions for identified issues. - Supports Markdown or JSON output formats.

What’s Changed

Security and visibility release: Action inputs are passed through environment variables instead of inline shell interpolation; audit targets are confined to GITHUB_WORKSPACE; Markdown reports now appear in the GitHub Job Summary; findings include one optional free-diagnosis link; and wrapper tests cover safe, failing, missing, and hostile path inputs across the three hosted runner operating systems.

• This action is used across all versions by 2 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action installs a Rust toolchain specification and optional components and targets in a CI workflow. It automates the setup of Rust development environments by handling complex Rustup configurations and ensuring reproducible builds across different platforms. The action provides flexibility to install specific versions or nightly builds of Rust, as well as add custom Rustup components and targets for cross-compilation.

What’s Changed

First stable release of seapagan/setup-rust.

• Installs a requested rustup toolchain specification, including explicit Rust versions and standard channels such as stable, beta, and nightly.
• Installs optional rustup components and Rust targets.
• Selects the requested toolchain for subsequent job steps through RUSTUP_TOOLCHAIN, without changing rustup’s persistent default toolchain.
• Integration-tested on GitHub-hosted Linux, Windows, and macOS runners.

Installing a target provides Rust target support only. It does not install external linkers, SDKs, or cross-compilers.

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The config-file-from-env GitHub Action replaces environment variables in a specified config file with their corresponding values. This automates the process of handling configuration files by dynamically inserting environment variable references into your configuration files, making them more flexible and easier to manage across different environments or deployments.

What’s Changed

• feat: Add support for .env files (e706be3)
• chore: More info (d440258)
• feat: Initial version (e440a96)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the deployment of a Docker Swarm service. It performs two main tasks: first, it runs npm ci and npm run bundle to prepare the project for deployment; second, it commits the dist folder to the repository to ensure all necessary files are included in the build artifacts. This ensures that the service is ready to be deployed without errors.

What’s Changed

• fix: Update dependencies (5336574)
• fix: Update dependencies (e9c2fe7)
• fix: Update dependencies (0b48905)
• fix: Update dependencies (7cff14c)
• fix: Improve error output (7cd1d73)
• fix: Improve error output (92f3eca)
• fix: Improve error output (4db44f1)
• fix: Update dependencies (0ff3213)
• Create README.md (e1316ba)
• fix: Run bundle in Linux container to ensure dist is the same locally and on github (eb002ab)

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action integrates Google Sheets with GitHub Classroom to automatically send assignment results. It requires setting up Google Cloud credentials and secrets for authentication and sharing the sheet with the service account email. The workflow step should be configured to include task results and the corresponding table ID of the Google sheet.

What’s Changed

• Updated comments (bf17880)
• Updated .dockerignore (498a6f7)
• Updated readme (bbb6b5a)
• Changed dockerfile to docker pull (8c8584b)
• Changed dockerfile to docker pull (23fa131)
• Fixed inputs (844c583)
• Merge pull request #5 from SPGC/using-result-base64-string (042d99f)
• Fixed input name (92dd201)
• Merge pull request #4 from SPGC/using-result-base64-string (79dad97)
• Code cleanup and fix bug with empty env variables (b474731)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Purpose: The Tirith — IaC Governance plugin GitHub Action automates infrastructure governance by evaluating Terraform plans against policies using the Tirith CLI. It helps protect sensitive values, enforce centralised governance, and surface actionable results before changes are applied.

Problems Solved/Tasks Automated:

• Evaluates Terraform plans for compliance with defined policies.
• Protects sensitive information from exposure during infrastructure deployment.
• Enforces centralized governance policies across multiple pipelines.
• Provides real-time feedback on policy violations through pull-request comments and check runs.

Key Capabilities Provided:

• Runs policies locally or remotely using StackGuardian credentials.
• Supports both default local mode and remote evaluation modes.
• Reports policy outcomes as sticky comments and check runs in pull requests, setting job exit codes to prevent changes from being applied if violations are found.

What’s Changed

What’s Changed

• [SG-4885] feat: the Tirith IaC Governance action — zero-config, with a credential-free local mode by @refeed in https://github.com/StackGuardian/tirith-iac-governance-action/pull/182

Full Changelog: https://github.com/StackGuardian/tirith-iac-governance-action/compare/v1.0.0-beta...v2

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action “AI Triage Bot” automates issue and pull request triaging using Gemini, a language model. It checks code claims against actual code to label issues (bug, enhancement, etc.) and pull requests (good-pr, needs-work) with comments. It also detects duplicates and floods, implements antispam and anti-abuse measures, and has optional features for GitHub Discussions Q&A, AI Agent PRs/issues opening, commit review, and workflow dispatch.

What’s Changed

• fix(action): unique marketplace name and short description for validation (9cadc73)
• feat: move action.yml to repo root for GitHub Marketplace listing (937cab8)
• test(config): make env-dependent config tests runner-deterministic (2b7cd7f)
• feat: publish AI Triage Bot — Gemini-powered issue/PR triage GitHub Action (d122cac)

• This action is used across all versions by 145 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action sets up Tombi in your GitHub Actions workflow, allowing you to easily integrate Tombi into your CI/CD pipeline for managing dependencies. It supports installing a specific version of Tombi, using a lock file to resolve the version automatically, and verifying checksums to ensure integrity during installation. The action also offers options to enable or disable caching for efficient reuse of previously downloaded artifacts.

What’s Changed

This setup-tombi release matches tombi v1.4.0.

Full Changelog: https://github.com/tombi-toml/setup-tombi/compare/v1.3.5...v1.4.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action ToQuery/wails3-build-action@v3 automates the building of Wails.io v3 applications. It installs GoLang and NodeJS, builds the application, and optionally uploads the results to GitHub or a release on tag. Key capabilities include building for various platforms, obfuscation, caching, and uploading artifacts.

What’s Changed

Full Changelog: https://github.com/ToQuery/wails3-build-action/compare/v3-alpha.14...v3-alpha.14

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The darnlink GitHub Action automates the process of healing Markdown links in a documentation tree by automatically updating links’ paths and UUIDs when files are moved or refactored. It works with both local and cross-repo web links, providing deterministic self-healing capabilities for Markdown documents over time. The action is available on PyPI and can be easily integrated into workflows using uv tool to run it without installation.

What’s Changed

The web axis is forgiving by design: a destination that fetches 200 without a uuid is web_unverifiable and the run still exits 0, because the file lives in someone else’s repository and cannot be fixed from here.

That is right for a third party and wrong for a destination you own: there it is not an external limitation, it is a missing two-line edit in a repo you control — and nothing ever told you so. This release closes that blind spot.

Added

• --own OWNER (repeatable, stripped and case-folded) names the owners you control. --own-from-origin adds this repository’s origin owner — a separate flag rather than a magic --own auto, so an owner literally called auto stays expressible. If it cannot resolve, the run is a usage error, even when explicit owners were given: it is a request, not a fallback.
• web_own_no_uuid at exit 4, not 3. Exit 3 promises “re-run with --write”, and darnlink cannot fix this one — the edit belongs to the destination repository. The message names owner, repo and path, and never suggests --write.
• --own-max N budgets it, so a repository can adopt the rule before reaching zero. The budget silences the verdict, never the finding, and never shields another exit-4 cause. The report says where the count stands in all four cases — including over budget, because a budget that goes silent exactly when it is exceeded is the one moment its number is worth reading.
• <!-- darnlink-own-exempt --> for a destination that is machine-regenerated, where a uuid is futile: the next refresh wipes it and the anchor points at nothing. It exempts from the new finding, from anchoring, and from web_mismatch — a regenerating destination is precisely one whose uuid drifts. Honoured with or without an owner set: it states a property of the link, not of the run.

Two exclusions, both textual and offline: a destination that is not .md can never carry frontmatter, and one pinned to a commit SHA can never be given one retroactively. Tags are deliberately not excluded — a tag is textually indistinguishable from a branch of the same name, so honouring it would need the network and would exclude a maintenance branch for looking like a tag, which is a false green.

Compatibility

Opt-in throughout. With no owner set, behaviour is byte-identical in the text report, the exit code and the files on disk — measured across 13,500 cases — with two departures the specification names: the exemption marker, and three keys --json gains unconditionally so a consumer can tell both that the axis ran and under what budget.

Upgrading

Bump your pinned ref to v0.21.0. Nothing changes until you pass --own.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action automates the process of identifying codebase drift, drift score, risk score, and prioritized upgrade priorities for AI coding agents. It provides a deterministic code graph and runtime/framework lag assessment, dependency age and EOL proximity scoring, and prioritized fix lists to help developers ensure their projects are up-to-date with dependencies and frameworks.

What’s Changed

Vibgrate CLI 2026.813.1

Released 2026-08-13

This release of the Vibgrate CLI includes several important fixes and enhancements to improve the user experience and accuracy of scans. Notably, architecture layer detection has been expanded to support a wider range of languages and frameworks.

What changed

New

• Architecture layer detection now recognizes .NET solutions, classifying C#, F#, VB, and Razor files according to PascalCase conventions and common NuGet packages.
• Architecture layer detection has been extended to cover multiple languages, including Java, Python, Go, Ruby, PHP, Swift, Dart, and Elixir, with popular packages mapped to layer tech stacks.

Fixed

• vg fix --dry-run no longer prompts for a plan tier, allowing for a preview of the recommended plan without writing files.
• vg scan now correctly sends the repository’s git remote URL during the pre-scan check, preventing miscounts of repositories in fresh clones.
• Scans on Windows now report project paths consistently with / separators, ensuring proper deduplication and sorting across different scanners.
• vg daemon ensure now waits up to 30 seconds for the background daemon to respond, addressing issues with flaky status confirmations on slow cold starts.

Benchmarks

Two-arm benchmark of this release against 2026.807.1, interleaved on one runner against the pinned corpus (189 metrics compared).

2 regression(s) — published, not omitted:

• Tasks passed on both arms: 33 → 31 (-6.1%)
• Comparable-task rate (both arms passed / total): 0.94 → 0.89 (-6.1%)

Full report and methodology: https://vibgrate.com/cli/benchmarks

Install or update

npm install -g @vibgrate/cli
vg

Full changelog: https://vibgrate.com/changelog/cli/2026.813.1

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action is an AI-powered security auditor for Symfony applications that targets application-level logic flaws missed by traditional static analysis tools and multi-agent review loops. It provides a comprehensive, adversarial approach to auditing Symfony projects and can emit validated reports in various output formats including console, JSON, SARIF, HTML, and Markdown.

What’s Changed

What’s Changed

• chore: sync 1.x changelog after the 1.19.0 release by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/306
• ci: auto-tag and draft a release on a release commit by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/307
• ci: add a manual replay trigger to Auto Release by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/308
• ci: allow the release scope and require squash-merge by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/309
• ci(release): add an optional publish input to Auto Release by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/310
• docs: fix inaccuracies in the 1.19.0 changelog by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/317
• chore(release): prepare 1.19.1 by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/321

Full Changelog: https://github.com/vinceAmstoutz/symfony-security-auditor/compare/1.19.0...1.19.1

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The agents-md-facts GitHub Action generates a minimal AGENTS.md file from repository facts without guessing or introducing unnecessary information. It automates the process of documenting build and testing commands, entry points, toolchain conventions, and security settings to ensure clarity and efficiency in project management. The action checks for drift between the generated AGENTS.md and the repository to prevent issues during CI pipelines and ensures that the file is kept up-to-date.

What’s Changed

agents-md-facts 0.1.0

Author a minimal AGENTS.md from your repo’s facts. Never guessed.

Install

npx agents-md-facts

Highlights

• Detected commands, entry points, conventions
• Non-destructive refresh markers
• CI Action: Wolfe-Jam/agents-md-facts@v0.1.0
• Examples: Node/TS, Python, Rust, Go
• Vendor-free; built on the open AGENTS.md standard

npm: agents-md-facts@0.1.0

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Overweight: An all-in-one toolkit for managing and optimizing bundle sizes. It provides a CLI, Node API, and GitHub Action to automate the process of keeping your project’s asset sizes within acceptable limits. The tool supports various testers (gzip, brotli) and allows custom logic through extensions. With its configuration flexibility and extensibility, Overweight simplifies tracking changes in file sizes during development and ensures efficient code delivery.

What’s Changed

2.2.0 (2026-08-13)

Features

• add typings (1786d19)
• add typings (#65) (8cf3267)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the process of generating and reporting code coverage from Kover XML reports in Kotlin/Android projects. It supports multi-module support, flexible discovery methods, configurable thresholds, PR integration with coverage reports, and automatic updates, as well as tracking coverage history and trends.

What’s Changed

v3.1.27: PR #164 - chore(deps): update dependency @biomejs/biome to v2.5.6

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 16.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

B.IA is a GitHub Action that automates accessibility checks in CI/CD pipelines by mapping guidelines and using AI to evaluate code against predefined requirements. It helps companies ensure their products are accessible by focusing on an audience with the highest potential impact, thus reducing costs associated with implementing accessibility solutions for various user groups.

What’s Changed

• Update geminiService.ts (688e09b)
• Update README.md (dbe3d74)
• Update README.md (0f117a4)
• Update README.md (45026e8)
• Merge pull request #2 from YuriFAToledo/documentation (04a0849)
• Update README.md (8bb0621)
• Update README.md (efeffcc)
• feat: add pr flow (2bf86c4)
• feat: new gemini properties (0d597b1)
• fix: enforce properties at gemini json (313ff7b)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

ReleaseGuard is a tool that inspects GitHub Release assets to catch common issues such as missing platforms, mislabeled architectures, empty installers, version drift, and missing checksums. It helps users choose the correct download based on their OS and CPU architecture, ensuring downloads are reliable and accurate.

What’s Changed

ReleaseGuard v0.1.0 restores the release and adds a practical download advisor.

What it does

• Checks GitHub Release assets and quality gates.
• Detects the current platform and architecture.
• Recommends the exact installer to download, with a reason and alternatives.
• Supports explicit checks with --platform and --arch when reviewing a release for another machine.
• Runs locally; no telemetry, uploads, or model calls.

Quick start

npx --yes github:zhaoryder/releaseguard check zhaoryder/releaseguard
npx --yes github:zhaoryder/releaseguard check zhaoryder/releaseguard --platform macos --arch arm64

The same release includes installers for macOS (Apple Silicon, Intel, universal), Windows (x64, ARM64, x86), and Linux (x64/ARM64 AppImage and deb), plus native packages and checksums.

The previous release attachments deleted from GitHub could not be reconstructed byte-for-byte; this release was rebuilt from the preserved source and successful CI artifacts. The original v0.1.0 commit is retained as v0.1.0-legacy.

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action is designed to automate continuous integration (CI) processes for Deno projects. It simplifies the setup of CI pipelines by providing a predefined set of steps that include building, testing, and deploying code changes. The action automates many common tasks related to Deno development, reducing manual effort and ensuring consistency across different environments.

What’s Changed

2.2.0 (2026-08-13)

Features

• gh: release-asset uploads, the Gemini extension archive, and a coverage push to 98% (#352) (a678f35)

• This action is used across all versions by 0 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Git Velocity is a GitHub Action that analyzes your GitHub repositories to generate a game-like dashboard showing developer velocity metrics. It automates the process of tracking and visualizing code contributions, pull requests, issues, and more, providing gamification features like achievements, leaderboards, and streaks. The action supports local Git analysis for faster performance and is available as both a Go tool and a binary download.

What’s Changed

Changelog

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action, lgtmaybe, automates code reviews by analyzing pull request diffs using an OpenAI-compatible model. It identifies logic and correctness bugs, security vulnerabilities, missing tests, outdated or incorrect code, performance regressions, unnecessary complexity, intent misalignment, and potential “ponytail” code. The tool does not run the code but relies on context from surrounding lines in files to provide detailed reviews, reducing false positives.

What’s Changed

1.14.0 (2026-08-13)

Features

• engine: add a spec lens that checks the PR against its committed spec (#376) (d55e35e)

Bug Fixes

• stop one flaky provider call voiding a whole review round (#378) (6c59f86)

Dependencies

• bump the python-dependencies group and unblock pip-audit on aiohttp (#379) (d296f25)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Totem is a file-based toolkit that helps teams maintain project architecture and consistency by enforcing rules derived from plain-text lessons. It uses a local, zero-LLM linter to enforce these rules, ensuring deterministic behavior and reducing the risk of architectural mistakes.

What’s Changed

Cohort-link bump (no direct package changes). See .changeset/config.json for the fixed-cohort definition.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

GuardSmith is a governance tool that standardizes AI development standards and automates code review. It provides features such as generating new projects from templates, automating static analysis checks, identifying drift in policies, integrating into CI/CD pipelines, and managing multi-layered environments (OSS baseline + organization overlay + project-specific layers).

What’s Changed

What’s new

• GitHub Action moved to the repository root — use it with a single line: uses: novexar/Guardsmith@v0.3.0 (the old packages/action path is removed)
• npx-based execution — the action now runs the published CLI via npx @guardsmith/cli (pinned with the cli-version input) instead of checking out this repository and installing dependencies. Setup steps are gone and runs are faster. The guardsmith-ref input is replaced by cli-version.
• npm packages (@guardsmith/core / @guardsmith/cli) remain at 0.2.1 — the CLI itself is unchanged.

Usage

name: GuardSmith
on: [pull_request]
permissions:
  contents: read
  pull-requests: write
jobs:
  guard:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: novexar/Guardsmith@v0.3.0

On violations the job fails, the console report lands in the Job Summary, a SARIF report is uploaded (Code Scanning / artifact), and a summary comment is posted on the PR.

• This action is used across all versions by 3 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the execution of Nuon CLI commands within CI/CD workflows, supporting both OIDC federation and API token authentication. It simplifies infrastructure management by integrating Nuon’s capabilities directly into automated deployments. Users can configure and execute various Nuon CLI commands to manage organizations, apps, and installs within their GitHub Actions pipelines.

What’s Changed

• chore: update the preflight cmd (#14) (4a13d66)
• chore: improved version selection (#13) (8b7d21c)
• fix: yaml syntax error in description (#12) (58da122)
• feat: support using oidc with the cli (#11) (500be20)
• feat: use –no-input flag (#8) (b144959)
• feat: Make input command optional, allowing for setup use cases (#7) (1c320c6)
• fix: The NUON_VERSION env var was not being picked up by install script (#6) (866d9e5)
• feat: Set NUON_CONFIG_FILE variable for subsequent steps (#4) (352448d)
• fix: Use the correct value for NUON_VERSION while installing (#5) (0d28fb9)
• chore: rename for publication (#3) (3cc58a1)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the security analysis of smart contracts in CosmWasm, Solana, and EVM projects. It uses Odin Scan’s AI-powered tools to detect vulnerabilities and integrates seamlessly into GitHub workflows, providing automatic platform detection, PR comments, inline annotations, configurable thresholds, and SARIF uploads for native security alerts.

What’s Changed

• feat: add comment-triggered PR scans (ac72e5f)
• docs: expand findings-visibility section with threat model and annotation rationale (0404708)
• feat: add findings-visibility input for graduated public disclosure control (f18df59)
• fix: show findings detail in PR comment with fallback to medium (c2e43c8)
• fix: new comment per run, show only critical/high findings, rebuild dist (e237b62)
• feat: use GitHub App installation token for branded PR comments (3abce4e)
• feat: enrich PR comment with emojis, descriptions, and fix report URL (27cc2f2)
• fix: gzip SARIF before base64 encoding for Code Scanning upload (d9eed9f)
• fix: include sourcemap-register.js in dist (bd265af)
• docs: add privacy policy (b78db44)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The svelte-vitals-action is a GitHub Action that automates static SvelteKit code health checks on pull requests. It provides inline annotations, a job summary, and a single sticky PR comment that updates in place on each push. The action uses the svelte-vitals CLI for analysis and supports configuration via committed files, such as svelte-vitals.config.* and svelte-vitals-suppressions.json. It fails the job when gating findings are present and provides a report regardless of whether it’s a pull request or fork PR.

What’s Changed

Minor Changes

• 9f513e6: Update the bundled analyzer to svelte-vitals 0.45.1 / @svelte-vitals/core 0.41.1, a wide range covering several upstream releases. The action’s inputs and outputs are unchanged, and the step still fails on failOn severity rather than on any score — but that severity table itself moved, so read the first two entries before upgrading a workflow you rely on:

  • The default gate loosens: seo/description-presence drops from critical to warning. Under the default failOn: critical, a project whose only failure was a missing <meta name="description"> now passes the step where it used to fail it. If you were relying on that block, set failOn: warning or override the rule’s severity in your config. Three more severities moved, and they only bite under a non-default failOn: warning: seo/og-url info → warning (the one tightening — a previously green run can turn red), seo/og-description warning → info, and seo/single-h1 splitting per finding so that two or more <h1> is now info while a missing one stays warning. The seo::route scoring pair’s total weight drops from 110 to 100 as a result, so SEO and Health can shift a point or two with no finding change at all.
  • A previously green run can turn red from files that were never analyzed. A parse crash on argument-less $state() — let el = $state();, the idiomatic bind:this declaration — used to make the whole component invisible to every rule, silently. Those files are analyzed now, and what surfaces in them can include critical findings that fail the default gate. That is the fix working.
  • A rule that throws no longer fails the whole step. The run completes without that rule and its weight is removed from the Health denominator, so the score is not silently inflated. Previously the exception propagated and the action failed the job outright. Note the tradeoff: the action does not yet surface the analyzer’s non-fatal warnings, so the skipped rule’s id is not reported anywhere — a rule that fails now goes unmentioned instead of loud.
  • The job summary and the sticky PR comment are hardened against the analyzed project’s own content. Strings quoted from the repo under analysis — file paths, route ids, and rule messages embedding page content such as <title> text or JSON-LD values — can no longer forge report structure: an embedded newline, code fence, heading, [text](url) link or bare <tag> renders as inert quoted text. Visible on well-behaved projects in one place: a message containing a literal tag (Missing <title>) now renders as inline code, which also fixes table cells silently dropping such tags.
  • More of the project is reachable, so findings move in both directions. Head and heading resolution now follows a component imported through a kit.alias/kit.files.lib alias ($components, $ui, …) instead of only $lib/… and relative paths; every application/ld+json script on a route is analyzed instead of only the last one; and seo/single-h1 counts headings rendered by imported local components. False “Missing” findings on routes whose content lives in such components disappear and Health can rise, while defects inside them — an empty <title>, invalid JSON-LD, a second <h1> — become visible for the first time.
  • seo/json-ld-validity now checks @type against the schema.org vocabulary. A bare type name that is not an exact, case-sensitive schema.org type produces a warning, with a did-you-mean hint for a casing slip or a typo within edit distance 2. IRI and prefixed forms are never flagged, and a document whose @context names a non-schema.org vocabulary is exempt.
  • Several false positives removed. seo/json-ld-required-props was stale against Google’s current requirements — the Article/BlogPosting/NewsArticle, Organization and Person rows are gone, Product now accepts any one of review/aggregateRating/offers, Recipe needs only name + image, VideoObject drops description. security/handler-state-write and security/shared-state-import no longer fire on a universal +page.ts/+layout.ts that exports ssr = false; since the former is critical, that can turn a red run green. performance/render-blocking-script no longer flags non-executing script types (text/partytown, importmap, speculationrules). correctness/effect-as-onmount no longer flags an $effect reading reactive state through a member expression on an imported binding or a new …() local.

Patch Changes

• e40f45c: Fix the baseline input reporting every finding as new on projects whose svelte-vitals.config.* imports svelte-vitals — the shape the install wizard scaffolds.

  The baseline ref is analyzed inside a temporary git worktree, and that worktree has no node_modules in its ancestry, so re-loading the config file from within it threw on the import. The comparison caught the error and fell back to reporting everything, which is the opposite of what the input is for: a gate meant to show only new findings showed all of them. The action now hands its own config-file load to the baseline analysis instead of letting it look for one.

  Both sides of the comparison therefore run under the same config, so editing svelte-vitals.config.* between the baseline ref and the current commit no longer makes findings look new on its own.

• f2f9314: Update the bundled analyzer to svelte-vitals 0.46.0 / @svelte-vitals/core 0.42.0. Nothing the action reports changes: no rule severity, score, finding, annotation, job summary or sticky-comment output moves. Upstream’s visible work in this range is CLI-only (shell completion, spinner cursor restore, the ci install workflow scaffold, and the dispatch layer’s exit code), and the rest is internal refactoring plus two new library exports the action does not use yet.

• 18d8dea: Surface the analyzer’s non-fatal warnings as workflow annotations. analyzeProject reports config-file problems, version-floor notices, unparseable files it skipped, and rules that crashed and were dropped from the run — the action collected all of it and printed none of it.

  The crashed-rule case is why this matters now. A rule that throws no longer aborts the analysis; the run completes without it and its weight leaves the Health denominator, so nothing about the report looks wrong. Before, the exception propagated and failed the job outright. Without this, an incomplete scan passed the gate with no trace of which rule was missing.

  The gate is unchanged — these are annotations, not failures.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

PatchWitness is an independent evidence and policy gate for AI-generated code changes. It automates the verification of agent-authored patches by generating a verifiable Change Passport that checks scope, verifier integrity, test execution, secrets, dependency impact, and portable evidence. The action does not replace traditional AI reviewers but serves as a local-first, agent-neutral trust gate for ensuring high-quality code changes.

What’s Changed

PatchWitness v0.2.1

This patch release fixes the v0.2.0 clean-room failure when a committed pull-request diff is applied in a disposable worktree. The release removes the invalid positional - argument from the git apply invocation and adds regression coverage for committed base-to-HEAD gating, Change Passport generation, and offline verification.

The GitHub Actions guide now requires repository-specific dependency setup and uses PatchWitness’s real .[dev] path for its own example. No new runtime dependencies, integrations, or CLI features are included.

Validation completed before release: full tests with coverage gate, Ruff, mypy, Demo, package build and Twine validation, clean install, committed-PR clean-room gate, minimal and recommended profiles, plus strict protected-workflow blocking with PW003 and offline evidence verification.

PyPI publication is intentionally not part of this release.

• This action is used across all versions by 2 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the process of turning research papers into review-ready pull requests.

The action takes various inputs to select an arXiv paper, search query, or custom brief, and generates a draft PR with comprehensive evidence for review, including references cited, license flagged, tests written, honest scope discipline in the self-review, and alignment with the repository’s conventions. The output is a wired-in implementation that simplifies the development process by handling testing variance and providing a clear selection narrative.

What’s Changed

outrider.yml used a flat concurrency group:

concurrency:
  group: outrider
  cancel-in-progress: false

GitHub permits exactly one pending run per group, and when a third dispatch arrives it cancels the run already waiting — not the newcomer — with no error and no annotation. Firing four targets at one repo produced one run, one survivor, and two cancellations that read as CI flakes rather than lost work.

The group is now keyed by what the dispatch is working on:

group: outrider-${{ inputs['pin-arxiv'] || inputs['start-from-ref'] || github.run_id }}

Distinct papers and branches run in parallel — they touch different branches, so there was nothing to serialize. A genuine duplicate of the same target still queues behind its predecessor. Unpinned runs fall back to run_id, so a dispatch is never cancelled unless it’s provably a duplicate.

outrider-daily.yml and outrider-weekly-refine.yml keep their static groups deliberately: every drafter run commits to the same accumulated intel branch, so two in flight would race on the push.

Engine-side twin (for App-provisioned installs, which render their own outrider.yml): remyxai/remyx#558. CLI-side mitigation — outrider trigger warns when a run is pending, and --wait-for-slot serializes: remyxai/remyxai-cli#50.

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action prints “Hello World” or a personalized greeting to the log, automating the process of greeting someone by name. It solves the problem of programmatically sending greetings and provides capabilities for customizing the message based on input parameters.

What’s Changed

Full Changelog: https://github.com/RivieraKid/gha-kaniko/compare/v1...v0.0.1

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Argus is a GitHub Action that automates AI-based code reviews by running multiple specialized reviewers in parallel and using an evidence-based curator to verify findings before posting review comments. It helps identify real bugs while managing false positives, providing a more comprehensive approach to code quality assurance.

What’s Changed

What’s Changed

• Feed a repo’s CLAUDE.md/AGENTS.md to every reviewer by @sibinms in https://github.com/sibinms/argus/pull/70
• Release v1.2.34: project standards context (CLAUDE.md/AGENTS.md) by @sibinms in https://github.com/sibinms/argus/pull/74

Full Changelog: https://github.com/sibinms/argus/compare/v1.2.33...v1.2.34

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action, SolsynthExpressUpload, automates the process of uploading build artifacts to a specific version in DistributionCenter. It prepares an upload URL with the given release version, uploads the artifact to S3, computes its SHA-256 digest, and attaches it as an immutable artifact to the release. If the version does not exist, it creates a stable draft automatically. The action requires various inputs such as API base URL, product ID, API key, version, file path, platform, architecture, MIME type, and channel.

What’s Changed

Full Changelog: https://github.com/Solsynth/SolsynthExpressUpload/compare/v1.0.1...v2

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the deployment of a Docker Swarm service by bundling assets before they are pushed to a repository. It ensures that all necessary files, including the bundled distribution, are included in the commit process to facilitate smooth deployment and versioning.

What’s Changed

• feat: Update to latest Docker version (6435c1d)
• feat: Explicitly set traefik inbound network (70d83f9)
• feat: Automatically set placement preferences based on placement constraints to spread containers of a service across nodes (51af2c2)
• feat: Add support for depends_on (688c023)
• feat: Add support for service labels (a36e5ea)
• fix: Fix restart policy to always restart because containers sometimes exit with code 0 even though they had an error (01b34f4)
• feat: Add support for multiple external routes (d99208c)
• feat: Improve update config (3c87f67)
• feat: Add support for mounts, max replicas per node and stop signal and grace period (90fa02a)
• feat: Add support for resource limits and reservations (b33b12f)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

SSG is a static site generator written in Go that converts Markdown with YAML frontmatter into a complete website. It automates the process of building, serving, and deploying websites using features like templates, feeds, images, and SEO metadata.

What’s Changed

Installation

Quick Install (Linux/macOS)

curl -sSL https://raw.githubusercontent.com/spagu/ssg/main/install.sh | bash

Package Managers

• Homebrew: brew install spagu/tap/ssg
• Snap: snap install ssg
• Debian/Ubuntu: Download .deb file below
• Fedora/RHEL: Download .rpm file below

Checksums

See checksums.sha256 for file verification.

📖 Full documentation: https://github.com/spagu/ssg#readme

What’s Changed

• 1.8.30 — migration keeps menus, ssg mcp –http serves, entities decoded by @spagu in https://github.com/spagu/ssg/pull/125

Full Changelog: https://github.com/spagu/ssg/compare/v1.8.29...v1.8.30

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the process of integrating Assignment results from GitHub Classroom with Google Sheets. It allows instructors to automatically update their Google Sheet with students’ submission results, making it easier to track grading and progress in the classroom. The integration requires setting up Google API credentials and sharing a sheet with the service account email. Users can specify student names and task results within a GitHub Actions workflow and the action will handle updating the corresponding cells in the Google Sheet.

What’s Changed

First working version with basic functionality

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action “Jira Release Annotator” automates the process of updating JIRA issues with a release tag and component name. It uses a tag name and a list of issue IDs to annotate JIRA tickets, which helps in managing and tracking updates across different projects efficiently. The action requires a Jira login and token for API access, making it useful for continuous integration pipelines.

What’s Changed

What’s Changed

• Update release workflow to use client_id (#210) @axdotl
• ⬆️ run action on Node 24 (#209) @stefan-scheidewig
• Bump undici from 6.27.0 to 6.28.0 (#208) @dependabot[bot]
• Bump eslint from 10.5.0 to 10.8.0 (#207) @dependabot[bot]
• Bump Staffbase/gha-workflows/.github/workflows/template_release_drafter.yml from 14.1.0 to 15.1.1 (#205) @dependabot[bot]
• Bump @vercel/ncc from 0.44.0 to 0.44.1 (#206) @dependabot[bot]
• Bump picomatch to 2.3.2 to resolve GHSA-3v7f-55p6-f55p (method injection in POSIX character classes) (#204) @copilot-swe-agent[bot]
• Bump transitive brace-expansion to patched 1.1.16 (GHSA-3jxr-9vmj-r5cp) (#202) @copilot-swe-agent[bot]
• Fix brace-expansion DoS vulnerability (GHSA-3jxr-9vmj-r5cp / CVE-2026-13149) (#203) @copilot-swe-agent[bot]
• fix(deps): bump minimatch 3.x to 3.1.5 to resolve CVE-2026-27903 (#201) @flaxel
• Bump eslint from 10.4.0 to 10.5.0 (#199) @dependabot[bot]
• Bump js-yaml from 3.14.2 to 3.15.0 (#197) @dependabot[bot]
• Bump @vercel/ncc from 0.38.4 to 0.44.0 (#200) @dependabot[bot]
• Bump Staffbase/gha-workflows/.github/workflows/template_release_drafter.yml from 13.4.1 to 14.1.0 (#198) @dependabot[bot]
• Bump undici from 6.24.1 to 6.27.0 (#195) @dependabot[bot]

• This action is used across all versions by 5 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the execution of Salesforce Apex, LWC, and Flow tests. It reports coverage to the CLI logs and the GitHub step summary, and writes coverage reports to paths expected by quality tools like SonarQube/SonarCloud or Codecov. The action is configurable to run only certain types of tests, and provides a streamlined way to include tests in CI workflows.

What’s Changed

• pin action references and harden the usage examples

Full Changelog: https://github.com/svierk/sfdx-run-tests/compare/v1.1.0...v1.1.1

• This action is used across all versions by 2 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

ghstats is a GitHub Action that generates SVG cards summarizing a GitHub user’s profile, providing insights into various metrics like repository language breakdowns, commit activity, and contribution trends. It automates the process of visualizing user data in a visually appealing format, making it easier to share and present on a user’s GitHub profile README.

What’s Changed

Fixes

• commits_per_repo: "0" now means every commit instead of none. The pagination guard broke on seen >= maxPerRepo, so a cap of zero stopped before the first page and silently rendered empty productive-time, productive-weekday and most-commit-language cards — the opposite of what 0 already meant for top_repos. A cap of zero or less is now treated as no cap.

  Verified against a real repository: a cap of 100 still stops at 100 commits, while 500 and 0 both walk the full 382-commit history.

The default stays at 500, which is plenty for most accounts. Raising it matters when a repo holds more reachable commits than the cap and you want the all-time cards to reflect your full history — commit history is returned newest-first, so a cap keeps the most recent commits and drops the older tail.

Full Changelog: https://github.com/tiennm99/ghstats/compare/v1.6.1...v1.6.2

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the process of building Wails.io v3 applications. It installs necessary tools such as GoLang and NodeJS, builds the application for specified platforms, and optionally uploads the results to GitHub or releases on tagged builds. The action supports customizing build options like go version, wails version, and platform targets.

What’s Changed

Full Changelog: https://github.com/ToQuery/wails3-build-action/compare/v3-alpha.9...v3-alpha.9

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action is a testing framework for Bash scripts, focusing on developer experience with 93 assertions and additional features like spies, mocks, data providers, and snapshots. It automates the process of writing, running, and documenting tests for Bash scripts efficiently.

What’s Changed

✨ Improvements

• --output <text|tap|json|junit> prints the JSON and JUnit reports on stdout, so a pipeline needs no temp file; --report-json still writes its file alongside (#1018)
• bashunit::skip_if, bashunit::skip_unless, bashunit::skip_unless_command <cmd> and bashunit::skip_on <windows|macos|linux> mark a test skipped and end it, replacing bashunit::skip && return (#1019)
• Per-test # @timeout <seconds>, # @retry <n> and # @skip [reason] annotations override the run-wide flags in both directions; a malformed value aborts the run (#1020)
• [suite:<name>] sections in .bashunitrc name a set of paths and options; --suite <name> runs one (repeatable) and --list-suites lists them (#1021)
• --sandbox fails a test that runs an external command it did not mock, and --sandbox-allow <cmd,...> widens the baseline allowlist (ADR-012) (#1022)
• bashunit::mock_sequence <cmd> <answer>… answers each call with the next entry, so retry loops need no hand-rolled counter file; the last entry repeats once exhausted (#1023)
• assert_have_never_been_called <cmd> asserts a spied command never ran, printing the recorded calls when it did (#1023)
• assert_is_file_readable, assert_is_file_writable, assert_is_file_executable, their negatives and assert_is_file_not_empty give files the parity directories already had (#1024)
• assert_json_key_not_exists checks that a JSON path is absent, and assert_json_length the size of an array, object or string (#1025)
• bashunit bench --report-json <file> and --report-junit <file> write the benchmark run to disk, so a CI run leaves an artifact to store, chart and compare (#1028)
• bashunit bench --baseline <file> fails a run when a benchmark is more than --baseline-tolerance percent (default 10) slower than the recorded one, comparing medians; --baseline-update <file> records the new reference (#1029)
• --snapshot-prune deletes the snapshot files no test resolved, printing every path; full runs only, and never on a run with failures (#1030)

🛠️ Changes

• LCOV BRDA carries the arm’s execution count instead of a 0/1 taken flag, taken from the arm’s first executable line; BRF and BRH are unchanged (#1061)
• Performance: --coverage is about 10x faster — a run over this repo’s src went from 9.23s to 0.96s. The report phase classifies lines, scans declarations and branches and emits the whole LCOV report in one awk invocation per run instead of Bash loops and forks per file, hit data is grouped once, the DEBUG trap rejects untracked lines before recording, and the caches are read through the variable table (#1056, #1057, #1059, #1060, #1084, #1088, #1090)

🐛 Bug Fixes

• Coverage reports every file under --coverage-paths, not only the ones a test executed: an untouched file shows as 0/N (0%) and --coverage-min gates on that denominator. This repo reported 11 of its own 121 files. Percentages drop, because the old ones were measured over the files that ran (#1053)
• --coverage-diff counts a changed file that no test executed, instead of skipping it and letting a brand new untested file pass a --coverage-min 90 gate. A docs-only commit still reports 100% (#1054)
• Coverage read a statement ending in ) as a case arm, so x=$(foo) left the denominator while x=$(printf '%s\n') stayed. A ) now closes an arm only when no ( opened earlier on the line, recovering 456 executable lines of this repo’s src/. Percentages move in both directions per file (#1055)
• A brace inside a comment, a string or a heredoc no longer counts towards a function’s span, so a single stray { stops swallowing every later function in the file — 11 functions in this repo’s src/coverage/lines.sh were reported as 1, and END { inside an embedded awk program was reported as a function. FN, FNDA, FNF and FNH change; lines and branches do not (#1086)

👥 Contributors

• @Chemaclass
• @ColumbusLabs

Checksum

SHA256: defa50ff54c902acf33c17a2813a879defb349452b51f667736800e63c0156ae

Full Changelog: 0.46.0…0.47.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Symfony Security Auditor is an AI-powered security auditing tool designed to catch application-level flaws that traditional static analysis and dependency scanners might miss. It provides a multi-agent adversarial approach where an attacker hunts for vulnerabilities, while a reviewer culls false positives over three iterations before emitting a validated report in various formats such as console, JSON, SARIF, HTML, or Markdown. The auditor can be run as a standalone CLI tool or integrated into a Symfony application via the Symfony bundle. It includes features like dry-run mode to estimate costs and provide a live audit feed in the console.

What’s Changed

What’s Changed

• chore(deps): bump DavidAnson/markdownlint-cli2-action from 24.0.0 to 24.1.0 by @app/dependabot in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/227
• chore(deps): update symfony/ai-bundle from ^0.11 to ^0.12 by @app/dependabot in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/228
• fix(standalone): drop polyfilled ext-uri from the static build by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/229
• docs: use last models by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/230
• chore(deps): bump zizmorcore/zizmor-action to 0.6.1 by @app/dependabot in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/236
• fix(docs): drop the invalid expanded model mapping from examples by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/237
• chore: keep main at the released version by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/254
• fix: restore extra.branch-alias to unbreak CI by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/255
• fix(ci): resolve the root version deterministically by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/256
• ci: enforce the core layer boundary in deptrac by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/261
• feat: normalized score and A-F grade by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/262
• feat: –min-score CI gate by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/263
• feat: shields.io badge endpoint from the action by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/264
• feat: PR comment with the audit summary by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/265
• refactor: neutral surface archetype by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/266
• refactor: neutral application security map by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/267
• refactor: neutral synthesizer prompt wording by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/268
• refactor: carry pending reviews in a value object by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/271
• refactor: carry pending chunks in a value object by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/272
• refactor: carry wavefront conversation state in a value object by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/273
• refactor: type the batch request shape behind the ports by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/274
• ci: retarget dependabot by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/283
• chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 by @app/dependabot in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/281
• chore(deps): bump DavidAnson/markdownlint-cli2-action from 24.1.0 to 24.2.0 by @app/dependabot in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/282
• feat(agent): add XSSI detection for GET controller actions by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/284
• fix: PR-comment escaping and failing-gate message by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/276
• fix(standalone): block repo platform override by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/278
• chore: make the local test gates trustworthy by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/279
• docs: fix the duplicate Security heading by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/285
• fix: stop the audited project executing code by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/277
• fix(scan): close three secret-scrubbing gaps by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/280
• fix: prevent false-SAFE results and dropped findings by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/288
• fix: close four prompt/report injection gaps by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/289
• fix(domain): stop Vulnerability id() colliding on join by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/292
• ci(release): scope binary job’s write token by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/293
• ci: verify static-php-cli checksum before use by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/296
• fix(domain): stop fingerprint() colliding on join by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/294
• fix(scan): make ThisCallReachability linear-time by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/297
• test: fix SARIF slash-escaping mutant gap by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/300
• fix: harden git-filter, MCP path, and PR-comment exposure by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/290
• fix: reject negative token counts unconditionally by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/291
• fix(scan): stop RegexCodeSlicer segfaulting by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/301
• refactor(scan): decompose RegexCodeSlicer by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/302
• fix(scan): secret-scrubber gaps and hash collisions by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/303
• fix(scan): scan-config path traversal and ReDoS gaps by @vinceAmstoutz in https://github.com/vinceAmstoutz/symfony-security-auditor/pull/304

Full Changelog: https://github.com/vinceAmstoutz/symfony-security-auditor/compare/1.18.0...1.19.0

• This action is used across all versions by 2 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Picket is a MIT-licensed secrets scanner for .NET that provides a Gitleaks-compatible command surface, Native AOT release binaries, dotnet tool packages, and embeddable libraries. It automates scanning staged, unstaged, and untracked non-ignored Git changes, as well as GitLab issues, comments, releases, and release assets using various authentication methods. The action supports CI integrations through GitHub Actions and Azure DevOps, with options for customizing reports and handling findings.

What’s Changed

Release artifacts include SHA-256 checksums, package-size metadata, and GitHub artifact attestations.

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 16.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

B.IA is a GitHub Action that enables companies to integrate accessibility checks into their CI/CD pipeline. It uses AI to analyze and measure the WCAG guidelines against defined audiences, allowing them to focus on specific groups that represent higher revenue potential. This helps in avoiding ineffective or harmful solutions by focusing on accessibility for targeted users efficiently.

What’s Changed

• feat: add parse debug (229d26d)
• feat: json response schema (3d2a1fe)
• feat: update build (1646112)
• feat: update code (41bf74f)
• feat: update dist (5ffd432)
• feat: add githubToken in action (b20caef)
• feat: add logs for debug (a29f11d)
• fix: order (75ba53e)
• feat: add runController (7338606)
• feat: add service (34c25e0)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

ReleaseGuard is a GitHub Action that provides a quality gate and download advisor for GitHub Release assets. It helps identify missing platforms, mislabeled architectures, empty installers, version drift, and missing checksums in release files, guiding users to the most suitable download based on their operating system and CPU architecture.

What’s Changed

• Fix and verify macOS app signatures (e3a443e)
• Redesign desktop UI and app mark (91ee6e7)
• Fix Linux desktop packaging metadata (4c4c118)
• Add cross-platform desktop app (085ba0d)
• Prepare Action for GitHub Marketplace (58a8ca0)
• Add Simplified Chinese README (149f01d)
• Pin Action execution to release tag (f6d2afb)
• Launch GitHub Release quality gate (92a219b)

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Zuke is a type-safe build automation system for Deno & TypeScript. It allows you to define builds as TypeScript classes with fluent APIs that reference each other by this.x, forming a dependency graph that Zuke resolves and runs in topological order.

What’s Changed

2.1.0 (2026-08-13)

Features

• ai: drive review discussions on GitLab, Azure and Bitbucket (#336) (f92f929)
• ai: findings as inline review threads on GitHub (#343) (0f39ce9)
• ai: point a dismissal at the suppress list as the cross-PR override (#345) (11a2b55)
• ai: resolve a reworded finding onto the identity it already has (#338) (1533b88)

Bug Fixes

• ai: compare a reworded finding against still-open findings too (#341) (5b65329)
• ai: stop model text from forging the review state block (#340) (c6b7115)

• This action is used across all versions by 2 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates setting up Node.js environments in CI workflows by detecting the package manager, enabling Corepack when necessary, restoring the correct cache, and installing only when required. It solves problems related to cold cache misses, trade-offs between installation time and cache usage, and the retry trap caused by post-step cache saves. The action is designed to improve build efficiency and reduce costs by caching builds that are not affected by changes in dependencies or lockfiles.

What’s Changed

Highlights

• Add opt-in cache-electron: "true" support that stores Electron runtime artifacts and native-addon prebuild downloads in workspace-scoped dependency caches.
• Give enabled Electron caches a versioned key segment so existing immutable dependency caches cannot masquerade as containing lifecycle artifacts. Disabled/default behavior keeps the existing cache paths and key.

Fixes

• Ensure a pnpm lookup-only primer miss installs into and saves the workspace-local pnpm store.

No migration is required. Electron caching remains disabled by default and can be enabled consistently on cache primer and consumer jobs.

Full changelog: https://github.com/pwrdrvr/configure-nodejs/compare/v1.3.0...v1.4.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Open Growth Loop is a technical documentation assistant designed to help maintainers of open-source repositories prioritize their work. It analyzes the repository’s hygiene, assesses its readiness for contributors, and suggests actionable next steps based on evidence. The action supports both local-only mode and integration with GitHub APIs to gather additional context.

What’s Changed

Open Growth Loop v0.2.1 is the GitHub Marketplace readiness release for the reusable Open Growth Loop Audit Action.

Changed

• Shortened the Action description to satisfy GitHub Marketplace metadata requirements.
• Identified the Action author as Jesus (R3ijar) in public Marketplace metadata.
• Updated official GitHub Actions dependencies to current Node.js 24-compatible major releases.

The CLI and repo-steward skill are unchanged from v0.2.0. All 91 tests pass across Python 3.10–3.13, Ruff passes, the Repository Audit passes, and trusted publishing successfully delivered the package to PyPI.

Install

pip install --upgrade open-growth-loop

• PyPI package
• Compatibility study
• Maintainer field test

• This action is used across all versions by 7 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

rumdl is a high-performance Markdown linter and formatter written in Rust, offering speed, extensive lint rules, automatic formatting with --fix, and support for multiple Markdown flavors. It’s designed to help maintain consistent and best practices in Markdown files, providing modern CLI features and integration options for various environments.

What’s Changed

Fixed

• lsp: honor per-directory config across workspace features (2c7670f)
• core: align path-aware document processing across adapters (7285b7a)

Performance

• lsp: construct workspace index rules directly (864e42a)

Downloads

Installation

Using uv (Recommended)

uv tool install rumdl

Using pip

pip install rumdl

Using pipx

pipx install rumdl

Direct Download

Download the appropriate binary for your platform from the table above, extract it, and add it to your PATH.

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

AgentAuditKit automates the security auditing of AI agent pipelines by scanning and reporting on misconfigurations, hardcoded secrets, tool poisoning, and other potential vulnerabilities across 10 different platforms. Unlike hosted scanners, AgentAuditKit runs fully offline and deterministically, producing auditor-ready compliance-evidence packs that cover a wide range of security categories including EU AI Act, SOC 2, ISO 27001/42001, HIPAA, NIST AI RMF, and regional regimes.

What’s Changed

Installation

pip:

pip install agent-audit-kit==v0.3.74

Docker:

docker pull ghcr.io/sattyamjjain/agent-audit-kit:v0.3.74

GitHub Action:

- uses: sattyamjjain/agent-audit-kit@v0.3.74
  with:
    fail-on: high

Supply chain

• rules.json — deterministic rule bundle
• rules.json.sha256 — trusted digest
• sbom.cdx.json / sbom.spdx.json — CycloneDX + SPDX SBOM
• *.sigstore — Sigstore keyless signatures (verify with agent-audit-kit verify-bundle)

What’s Changed

• Session-splice rule (AAK-AGENT-COMPOSE-002), one live NVD feed, and a count guard that catches prose drift by @sattyamjjain in https://github.com/sattyamjjain/agent-audit-kit/pull/571
• CVE response: pin CVE-2026-72768 (n8n MCP Client SSRF) + CVE-2026-73222 (claude-code-templates –studio RCE) by @sattyamjjain in https://github.com/sattyamjjain/agent-audit-kit/pull/572

Full Changelog: https://github.com/sattyamjjain/agent-audit-kit/compare/v0.3.73...v0.3.74

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The SFDT action automates the deployment, testing, and release process for Salesforce projects. It offers features like interactive workflows, preflight validation, AI-powered fix plans, and CI/CD pipeline templates to streamline development and reduce errors. The multi-package project support allows deploying to individual packages or specific source directories directly.

What’s Changed

What’s Changed

• chore: release extension v0.13.0 by @scoobydrew83 in https://github.com/scoobydrew83/sfdt/pull/336

Full Changelog: https://github.com/scoobydrew83/sfdt/compare/v0.22.1...ext-v0.13.0

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 16.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action uses Amazon Bedrock Agent to analyze files in a pull request and provide AI-powered feedback, enhancing code quality, security, and performance. It allows customization of prompts using Bedrock Agents, supports memory for context across PRs, and integrates with Knowledge Bases for enhanced accuracy and relevance.

What’s Changed

What’s Changed

• 21 closing pr should end agent session by @severity1 in https://github.com/severity1/custom-amazon-bedrock-agent-action/pull/27

Full Changelog: https://github.com/severity1/custom-amazon-bedrock-agent-action/compare/v0.8.0...v0.9.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Sherpa.sh is an AI tool that automates infrastructure deployment and configuration based on plain English prompts. It supports multiple cloud providers, frameworks, and configurations, allowing developers to describe their needs in natural language and have it translated into optimized infrastructure setups. The action integrates with GitHub Actions and the Claude Code CLI for seamless deployment workflows, enabling users to deploy applications quickly and easily across various cloud environments.

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The greenbump action automates the process of upgrading dependencies while ensuring that breaking changes are fixed using an AI agent. It helps bring your own Anthropic API key to verify against real tests before merging updates, making it a safer and more efficient option than manually reviewing every upgrade.

What’s Changed

See CHANGELOG.md for details.

Full Changelog: https://github.com/shidesheng0218/greenbump/compare/v0.2.0...v0.2.1

• This action is used across all versions by 13 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Release Creator is a GitHub Action that automates the creation of GitHub Releases from conventional commit history. It generates structured release notes grouped by commit type and automatically detects pre-release status from SemVer identifiers. The action supports multiple release note formats, such as grouped, conventional, flat, and GitHub-native, allowing for customization of how releases are presented.

What’s Changed

🐛 Bug Fixes

• report truthful suite totals #skip (d583cba)
• route note failures through policy #skip (9ca86a0)
• validate constrained inputs #skip (cdf00a9)
• preserve asset glob depth #skip (7190b76)
• keep draft floating tags unchanged #skip (9e16890)
• pin floating tag target #skip (fcd6a35)
• reject non-tag ref fallback #skip (06551d2)
• report complete coverage (0b4544d)

📖 Documentation

• document draft floating-tag skip #skip (5c04131)
• remove duplicate contributor metadata #skip (1b21dc3)

🔧 CI/CD

• update coverage badge [skip ci] (7d2c6d4)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the deployment of a Swarm service by preparing it for production. It ensures that all necessary dependencies are installed and bundled, making it ready to be deployed with minimal configuration changes. The action streamlines the process of deploying services from development to production on Docker Swarm environments.

What’s Changed

• fix: Update dependencies (5336574)
• fix: Update dependencies (e9c2fe7)
• fix: Update dependencies (0b48905)
• fix: Update dependencies (7cff14c)
• fix: Improve error output (7cd1d73)
• fix: Improve error output (92f3eca)
• fix: Improve error output (4db44f1)
• fix: Update dependencies (0ff3213)
• Create README.md (e1316ba)
• fix: Run bundle in Linux container to ensure dist is the same locally and on github (eb002ab)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The d-vercel GitHub Action simplifies the deployment of frontend and full-stack applications to Vercel. It automates PR comments, supports monorepos, and allows for customized CI/CD pipelines. The action generates sticky comments on Pull Requests with deployment status, preview links, commit hashes, and logs, facilitating quick updates.

What’s Changed

What’s Changed

Γëí╞Æ├£├ç New: comment-marker input for monorepo workflows

d-vercel now supports a comment-marker input so you can set a distinct sticky comment marker per job. In monorepos (Turborepo/pnpm workspaces) where one workflow runs multiple d-vercel jobs ╬ô├ç├╢ one per app ╬ô├ç├╢ each job previously shared the same hardcoded marker, so the last job to finish overwrote the single PR comment.

Now each app keeps its own sticky comment, updated independently on subsequent commits.

- uses: Spectra010s/d-vercel@v1
  with:
    comment-title: "Vercel Deployment ΓÇö Web"
    comment-marker: "vercel-sticky-comment-web"

• New “Monorepo: Multiple Apps, One Workflow” section in the README (#13)
• Closes #12

Maintenance

• Bumped git-aic to 1.4.1, prettier to 3.9.6, and rollup to 4.62.4
• Fixed git-aic links in CONTRIBUTING.md

New Contributors

• @dependabot[bot] made their first contribution in https://github.com/Spectra010s/d-vercel/pull/14

Full Changelog: https://github.com/Spectra010s/d-vercel/compare/v1.2.0...v1.3.0

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the process of sending assignment results from GitHub Classroom to Google Sheets. It helps streamline grading workflows by automatically updating the specified columns with task scores and creating necessary rows as needed. The integration requires setting up Google Cloud API credentials and configuring secrets in your organization, then integrating it into a GitHub Actions workflow.

What’s Changed

• Updated comments (bf17880)
• Updated .dockerignore (498a6f7)
• Updated readme (bbb6b5a)
• Changed dockerfile to docker pull (8c8584b)
• Changed dockerfile to docker pull (23fa131)
• Fixed inputs (844c583)
• Merge pull request #5 from SPGC/using-result-base64-string (042d99f)
• Fixed input name (92dd201)
• Merge pull request #4 from SPGC/using-result-base64-string (79dad97)
• Code cleanup and fix bug with empty env variables (b474731)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Firebase Rules Audit GitHub Action is a local command-line tool that reviews Firestore and Cloud Storage security rules for common risky access patterns, including unconditional allow statements, public if true conditions, rules without a request.auth reference, and recursive wildcard paths. It provides static checks to help identify potential security vulnerabilities in the rules files without connecting to Firebase or deploying them. The tool can be run from the command line or as a GitHub Action, and it outputs both console and machine-readable reports for further automation.

What’s Changed

First stable release

Firebase Rules Audit is a local-only GitHub Action and CLI for flagging common risky Firestore and Cloud Storage security-rule patterns.

Highlights

• Detects unconditional allow statements and public if true conditions
• Flags rules that do not reference request.auth
• Reports recursive wildcard paths
• Provides console, JSON, and Markdown output
• Supports CI enforcement with fail-on-high

Use in GitHub Actions

- uses: subhan900/firebase-rules-audit@v1.0.0
  with:
    files: firestore.rules storage.rules
    fail-on-high: 'true'

This is static analysis, not a replacement for a complete Firebase security review.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates Tessl Code Review in GitHub Actions, handling pull-request resolution, exact-head checkout, Tessl CLI setup, review publication, stale-head protection, idempotency, failure notices, and result artifacts. It provides a quick start guide, configuration options, and review cadence support.

What’s Changed

The first supported release of the Tessl Code Review Action.

Pin the Action to this release’s commit SHA:

uses: tesslio/code-review-action@1907f303ffe89a7d65e298ee1183e4ccaeeb93b3 # v1

This revision installs Tessl CLI 0.96.0. A review runs the standard profile in advisory mode by default; see the README for gate mode, review cadence, and the lenses input, and the Action contract for supported configuration and outputs.

• This action is used across all versions by 145 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action sets up Tombi in your GitHub Actions workflow. It allows you to install Tombi CLI versions, either by specifying a version number, using a lock file, or with checksum verification for the downloaded archive and executable binary. The action supports caching and can be configured to use a custom cache directory.

What’s Changed

This setup-tombi release matches tombi v1.3.5.

Full Changelog: https://github.com/tombi-toml/setup-tombi/compare/v1.3.4...v1.3.5

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub action automates the building of Wails.io v3 projects. It installs GoLang and NodeJS, builds a Wails binary for specified platforms, and optionally uploads the build results to GitHub or a release tag. The action supports various configurations through input parameters such as build name, platform, and obfuscation settings.

What’s Changed

Full Changelog: https://github.com/ToQuery/wails3-build-action/compare/v3-alpha.14...v3-alpha.14

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the deployment of a new container image to a Railway service and waits for the deployment to succeed. It simplifies the process by leveraging the Railway public GraphQL API and handles multiple services concurrently through a matrix strategy. The action supports various configurations such as project, service name, image reference, environment, and debugging options to streamline CI/CD pipelines.

What’s Changed

Full Changelog: https://github.com/twopow/railway-deploy-action/commits/v1

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action, aicheck-scan, prevents coding-agent credential files from being committed to version control by failing the build if such files are detected. It uses a predefined list of file paths and checks for their presence in the repository before allowing a successful commit. The action can be integrated into CI workflows to automate this check.

What’s Changed

Breaking for the GitHub Action only. The CLI is unchanged.

Root Action is now aicheck agents. No network. No target input.

- uses: actions/checkout@v4
- uses: unauthdev/aicheck-scan@v2

Live-probe moved to uses: unauthdev/aicheck-scan/scan@v2 (still needs target:). uses: unauthdev/aicheck-scan/agents@v2 is an alias of the root Action. @v1 is frozen leftover live-probe. Do not move that tag.

SHA256 sums are appended below by the publish workflow.

SHA256

74b589cdeb6d8bb4db224e0e5e46290516d53aafeb484d07497796ac29e69746  aicheck_scan-2.0.0-py3-none-any.whl
e1f59f945f341ae28c1b08423be6ab15594cd088bfb9846c484f1b3520fb93ac  aicheck_scan-2.0.0.tar.gz

• This action is used across all versions by 15 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the application of declarative repository settings from a .github/settings.yml file using a fine-grained personal access token. It replaces the Probot Settings app and manages rulesets such as branch protection and push policies. The action provides visible, stateless workflow runs that report errors if apply fails. It also includes a JSON Schema for the configuration, which is generated from Zod schemas in src/schema.ts.

What’s Changed

2.1.0 (2026-08-12)

Features

• attest build provenance and attach the sigstore bundle to releases (d12eeb8)

Bug Fixes

• apply review fixes to the docs and tooling sweep (a849b19)
• apply review fixes to the harness audit batch (01e9e3b)
• apply review fixes to the src-side audit batch (ed29870)
• centralize the token-leak sweep in the runner (84f5ae1)
• classify rate limits structurally on every path (0c2eb3c)
• correct mock identity minting and the pages resurrect bug (5650244)
• cover every faultable section in the fuzz fault battery (f683bb3)
• derive owner-kind sensitivity from the section declaration (5d2b67e)
• discover schema-corpus scenarios across all scenario roots (4171f1b)
• harden the CI tooling (2c1b360)
• keep spec-pinned gaps out of automatic graduation (ae278c9)
• reject required-sections entries excluded by the sections allowlist (13b59f5)
• size the harness kill cap for the directed fuzz battery (8543af8)
• strengthen the remaining per-section representations (9567f3f)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

RustScript is an interpreter that runs Rust scripts without compiling them. It supports basic Rust features like functions, loops, conditionals, and error handling, but does not support complex types or standard library features. The main purpose of RustScript is to allow developers to quickly test and iterate on small scripts in Rust without waiting for a full compilation process.

What’s Changed

Full Changelog: https://github.com/VladasZ/rustscript/compare/v0.3.6...v0.3.7

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the detection of leaked secrets in source code, configuration files, and pipelines. It uses Rust to perform fast multi-stage scanning with features like fast matching, custom rules, and support for gitleaks-compatible configurations. The action can scan various sources including git-tracked files, changed files, full history patches, staged index blobs, and untracked files. It outputs results in multiple formats (text, JSON, JSONL, SARIF) and supports suppressions and baselines.

What’s Changed

Full Changelog: https://github.com/whit3rabbit/secrets-scanner/compare/v0.2.2...v0.2.3

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Picket is a secrets scanner for .NET that provides a command-line tool, an interactive report triage companion, and native AOT releases. It can scan staged Git changes, Hugging Face models, GitLab issues, and other resources using read-only tokens stored in environment variables or secret files. The action can be integrated into GitHub Actions and Azure Pipelines, and it offers agent guards for Codex and Claude hook events.

What’s Changed

Release artifacts include SHA-256 checksums, package-size metadata, and GitHub artifact attestations.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

cowork-harness is a testing tool that automates the testing of Claude Cowork skills by reproducing its observable runtime contract, including limits such as sealed filesystem and default-deny egress. It allows developers to script and automate end-to-end tests across various scenarios in a headless manner, making it suitable for CI pipelines without relying on the locked-down Desktop app. The tool provides options to test local skills with different fidelity levels (protocol, replay, live), each requiring varying prerequisites including token, runtime setup, and agent configuration.

What’s Changed

Added

• Platform baseline for Claude Desktop 1.28929.0 (bundled agent ELF 2.1.227). The modeled first-party spawn contract is unchanged: spawn.tools stays 20 entries, allowedTools 19, and the egress allowlist 15 domains. The Cowork system prompt, the sub-agent append, coworkSyspromptMap and the mount-mode anchors all passed unchanged, and the VM rootfs image is byte-identical, so no provisioning re-capture. The ELF’s SHA-256 matches Anthropic’s official linux-arm64 release manifest checksum. All three committed cassettes replay clean (re-stamped, not re-recorded — replay runs no live agent, so their recorded behaviour could not move).

  Two spawn-contract deltas, both classified rather than bypassed:

  • Desktop can now splice an Artifact tool into the session tool list, between AskUserQuestion and ToolSearch. It is selected by a server-delivered session flag, not a feature gate — the flag arrives with the session config alongside memoryEnabled/skillsEnabled, so it is invisible to gate diffing and can change without a Desktop release. It is off for a default first-party session, so the rendered tool list is unchanged and Artifact is not added to the pin.
  • Desktop constructs one new spawn-env key, CLAUDE_CODE_COWORK_FRAME_ARTIFACTS, gated on that same flag. It is allowlisted rather than pinned: a default session never receives it, so pinning would bake a value into the baseline that production does not send. provenance.spawnEnvKeys grows 60 → 61 to record that Desktop constructs it.

  Also recorded: the coworkRuntimeConfig gate now serves a 1 h (was 15 min) TTL for the host-loop web_fetch dedup cache. The harness reads that value from the baseline, so the change is carried automatically; the code-level fallback is unchanged and still mirrors Desktop’s own absent-key default.

• Guards for the conditional Artifact tool and its spawn-env key. sync admits the new spread only while it still resolves to the frame-artifacts predicate. The check walks the real chain — condition → attended-turn wrapper → predicate — capturing each callee rather than hard-coding minified names, and matches the condition as a whole expression anchored at both ends. Fragment matching is not sufficient and was the defect in an earlier draft: appending ||!0, flipping the cached arm, or replacing the trailing restriction all make Artifact unconditional while still containing the right call. A companion check asserts the env key stays gated on the same predicate as the tool, in both directions, because allowlisting a key is unconditional by construction — without it, making either unconditional or re-keying one of them would be absorbed silently. Fifteen mutations covering these paths are executed as tests.

• Two drift sentinels in the synced baseline’s provenance.gates: the skill-argument collection guidance flag (on for a standard account) and the auto-mode permission rubric flag (dark). Neither flag name appears in the asar, so both carry kebab-case descriptors under the existing name caveat rather than names shaped like verified flags.

Changed

• The tools-list tail guard now pins the whole tail. It previously anchored only on the first spread after ToolSearch, leaving everything past it unguarded — which defeated its own stated purpose, since a tool appended there was invisible to both it and the head check. That region already held a second conditional tool. The tail is now pinned through its closing bracket, with the trailing tool’s name and its condition both resolved rather than shape-matched: swapping either would otherwise pass silently.

• The CI boundary-parity job pulls the pinned agent-image digest instead of the floating :2 tag. CI previously certified whatever was published last while doctor certified the pin, so a green CI said nothing about the pinned image and vice versa. Both now validate the same bytes, and a pin naming a digest that was never pushed fails the gate rather than silently falling back to a rebuild.

Fixed

• The egress proxy answered nothing when a CONNECT upstream failed before the tunnel was established. A transient failure on an allowlisted host — DNS, a TCP reset, an unreachable route — destroyed the client socket with no HTTP response and no log record anywhere. The client saw the proxy accept CONNECT and then vanish (curl: (56) Proxy CONNECT aborted), and container logs were empty, so an intermittent left nothing to diagnose. The asymmetry was accidental: the plain-HTTP forward path already answered 502 on the same class of failure. CONNECT now matches it and emits a structured upstream_error line.

  The 502 is written only before the tunnel is established — afterwards the socket is a raw tunnel and an HTTP status would corrupt the stream. No egress-log row is written either way: allow is recorded only after a successful connect precisely so a failed request cannot false-pass egress_allowed, and deny would be untrue since the host is allowlisted and nothing was blocked.

  The egress proxy image tag moves to cowork-egress-proxy:5. The tag is the cache key, so existing installs would otherwise keep serving the old proxy while doctor reported it healthy. No action is required — the image is rebuilt automatically when the tag is absent.

• The two allowlisted boundary probes retry (--retry 2 --retry-all-errors). A single-shot request through the proxy is exposed to the same ordinary transients, which failed a probe once in eight runs while the sandbox was behaving correctly. The off-list probes deliberately do not retry: they assert a 403 deny, and retrying a policy decision could turn a real enforcement failure into a later pass.

• Release tags no longer move the floating :2 agent-image tag. Every release rebuilt both image variants and repointed :2, while nothing re-recorded docker/agent-image.json — whose digests are transcribed by hand from a log line that tag-push builds never emit. Pin and tag therefore diverged permanently after the first release. docs/maintenance.md already stated the intended contract (move :2 in the same release that ships the updated pin); the workflow now implements it. :2 remains movable by an explicit dispatch, which is how a deliberate image refresh has always been described.

Documentation

• docs/fidelity-gaps.md gains four sections. Artifacts — two mechanisms, neither modeled (Cowork’s per-artifact bind-mounts and the newer Artifact tool are mutually exclusive, the selecting flag is not observable locally, and the harness models neither); HIPAA restriction is a process-global latch; Auto-mode permission rubric is not modeled (dark, and scoped to sessions the harness does not model); and Skill argument collection — the elicitation form branch is not reachable here, which records that production splits between AskUserQuestion and an elicitation form while a harness run deterministically takes the former. That last one is an open gap with a stated plan, not a closed question. The save_skill section notes the tool is now additionally governed by the permission rubric.

• RELEASING.md gains an agent-image checklist item. The release process never mentioned the image pin, which is what let the tag drift go unnoticed. It also notes that an unchanged Dockerfile.agent still yields different bytes on a rebuild, since its apt/pip/npm installs are unpinned.

What’s Changed

• release: 1.22.0 by @yaniv-golan in https://github.com/yaniv-golan/cowork-harness/pull/114

Full Changelog: https://github.com/yaniv-golan/cowork-harness/compare/v1.21.1...v1.22.0

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action generates and displays an open-source contribution banner for a GitHub profile README, aggregating contributions from other repositories. It helps users showcase their collaborative efforts across multiple projects. The action requires a Personal Access Token with read:user (and repo scope if including private repos) and can be configured to include specific tiles and date ranges.

What’s Changed

Full Changelog: https://github.com/yashksaini-coder/GitBanner/compare/v1.2.1...v1.3.0

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 4 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Summary: Boost is a GitHub Action that automates the process of wrapping and analyzing logs from CI/CD agents. It helps in saving tokens by trimming noisy logs and keeping important context such as errors, timings, and cache hits while maintaining agent output quality. This tool uses OpenTelemetry for monitoring and can be used to automate the initialization, running tasks, and reporting process of agent outputs.

What’s Changed

What’s Changed

• Release v0.7.23 by @yahav-ohana in https://github.com/jfrog/boost/pull/41
• Release v0.7.25 by @menachemm-byte in https://github.com/jfrog/boost/pull/44
• docs(readme): simplify mascot, focus on token savings, add report commands by @yahav-ohana in https://github.com/jfrog/boost/pull/47
• docs(readme): update release badge to v0.8.6 and stars to 258 by @yahav-ohana in https://github.com/jfrog/boost/pull/48
• docs(readme): add how-to-use walkthrough GIF above Quick start by @yahav-ohana in https://github.com/jfrog/boost/pull/52
• docs(readme): add Boost comparison table by @yahav-ohana in https://github.com/jfrog/boost/pull/53
• fix: install.ps1 by @menachemm-byte in https://github.com/jfrog/boost/pull/54
• docs: refresh README badges, install, use cases, and agent guide by @yahav-ohana in https://github.com/jfrog/boost/pull/56
• docs(readme): localize repo main page with language selector by @yahav-ohana in https://github.com/jfrog/boost/pull/59
• docs: clarify collection scope by @yahav-ohana in https://github.com/jfrog/boost/pull/60
• docs: surface JFrog Xray security scanning in README and SECURITY.md by @yahav-ohana in https://github.com/jfrog/boost/pull/61

New Contributors

• @menachemm-byte made their first contribution in https://github.com/jfrog/boost/pull/44

Full Changelog: https://github.com/jfrog/boost/compare/v0.7.23...v0.11.13

• This action is used across all versions by 0 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Gitscaffold is a command-line tool and GitHub Action designed to convert Markdown-based roadmaps into structured GitHub issues and milestones using AI-driven extraction and enrichment. It supports various features such as AI-powered issue extraction, roadmap synchronization, bulk deletion of closed issues, cleanup of issue titles, deduplication of issues, AI enrichment of descriptions, display of next action items, selection of the next open task for the current roadmap phase, comparison of local roadmaps vs GitHub issues, and more.

What’s Changed

• docs: Add release notes for v0.1.17 (774e5f5)
• fix: Properly mock load_dotenv in get_github_token test (38b8141)
• feat: Add uninstall command for clean removal of config and package (9be0afb)
• style: Normalize quoting for global config keys (3329e8e)
• fix: Prevent dotenv from loading real .env files in tests (5857e52)
• fix: Isolate test for global config token read (47e9759)
• fix: Resolve config test failures with robust parsing and mocking (8931215)
• fix: Update env handling tests for python-dotenv quoting (330874a)
• refactor: Secure config file permissions and add dedicated tests (d5404d6)
• test: Add unit tests for environment and config handling (0b67f70)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates various operations related to Serverless Stack (SST) applications, including deploying, diffing infrastructure changes, removing resources on PR closure, and staging deployments. It consolidates multiple composite actions into a single tool to streamline SST management workflows. The action supports deployment to specific stages, handling pull request-related operations, and provides customizable features like comment modes and output truncation.

What’s Changed

Release v0.7.42

Release Date: 2026-08-12 Previous Version: v0.7.41

🚀 What’s New

📦 Bundle Information

• Bundle Size: 1.51MB (1584536 bytes)
• Integrity Hash: 3ffa6987e95304a4...
• Format: ES Modules for GitHub Actions
• Target: Node.js 20+
• Source Maps: Included for debugging
• Distribution: Files included in repository at tagged version

🚀 Usage

- name: SST Operations
  uses: kodehort/sst-ops-action@v0.7.42
  with:
    operation: deploy  # deploy, diff, or remove
    stage: production
    token: ${{ secrets.GITHUB_TOKEN }}

🔗 Links

• Full Changelog
• Documentation
• Action Marketplace

Full Changelog: https://github.com/kodehort/sst-ops-action/compare/v0.7.41...v0.7.42

• This action is used across all versions by 3,445 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action generates Python data models from schema definitions in various formats and supports multiple input types, including OpenAPI 3, AsyncAPI, JSON Schema, Avro, XML Schema, Protocol Buffers/gRPC, GraphQL, MCP tool schemas, and raw data. It can also convert existing Python types (Pydantic, dataclass, TypedDict) into different output types. The action handles complex schemas and produces type-safe, validated code ready for IDEs and type checkers.

What’s Changed

What’s Changed

• Update CHANGELOG for 0.72.3 by @dcg-generated-docs[bot] in https://github.com/koxudaxi/datamodel-code-generator/pull/3724
• Update release benchmark data by @dcg-generated-docs[bot] in https://github.com/koxudaxi/datamodel-code-generator/pull/3725
• Update package metadata validation by @koxudaxi in https://github.com/koxudaxi/datamodel-code-generator/pull/3733
• Fix nullable forward reference unions by @koxudaxi in https://github.com/koxudaxi/datamodel-code-generator/pull/3732
• Split generation orchestration into phases by @koxudaxi in https://github.com/koxudaxi/datamodel-code-generator/pull/3726
• Split result emission paths by @koxudaxi in https://github.com/koxudaxi/datamodel-code-generator/pull/3727
• Split parser processing phases by @koxudaxi in https://github.com/koxudaxi/datamodel-code-generator/pull/3728
• Group single-module processing steps by @koxudaxi in https://github.com/koxudaxi/datamodel-code-generator/pull/3729
• Remove Astral sponsor logo by @koxudaxi in https://github.com/koxudaxi/datamodel-code-generator/pull/3735

Full Changelog: https://github.com/koxudaxi/datamodel-code-generator/compare/0.72.3...0.72.4

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action checks out a repository using plain git. It automates the process of cloning and fetching repositories, allowing for custom configurations such as sparse checkout and partial clone filtering. The action provides options to clean the checkout directory, fetch a specific number of commits or tags, and use authentication tokens for accessing private repositories.

What’s Changed

Initial release

This is the initial first stage release. Other actions will depend on this action.

The next release will include those additional actions in the workflows!

• This action is used across all versions by 0 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action scans and evaluates agents to ensure they adhere to security standards, detecting potential vulnerabilities such as injection attacks and data leaks. It also provides a comprehensive identity system for agents, including DID-based authentication and reputation management. The action integrates with existing toolchains and supports multiple programming languages for safe execution of scripts.

What’s Changed

AIShield v4.2.2

重点：GitHub Action 正式上架就绪

• 新增 action_entrypoint.py + Dockerfile ENTRYPOINT：Action 现在真正执行扫描（此前只启动服务器），产出 score / risk_level / JSON 报告 / SARIF。
• action.yml：source_url 改为可选（留空扫当前仓库），默认 no-spawn（不执行被扫配置）。
• 用法：uses: lm203688/aishield@v4.2.2，fail_on: high，SARIF 直传 GitHub Security。

生态位占位（docs/）

• docs/ecosystem-positioning-2026.md：agent 生态 4 层 + 数据层盘点，已介入/缺口、开源参考、执行清单。
• docs/trust-attestation-spec.md：可嵌入发现层的中立信任凭证 aishield-trust/v1（Server Card / Agent Card / ai-catalog 用 trust 字段引用）。
• docs/.well-known/agent-card.json 已 dogfood trust 字段。
• distribution/guardrail-harness/：forge / Goose / Open Interpreter 的 drop-in 内容安全护栏示例。

规则与能力

• 214 MCP / 220 Skill 规则，OWASP MCP Top 10 + Agentic ASI01–10 双维对齐。
• Agent 计算机「内容安全平面」叙事（与隔离运行时互补）。

Marketplace 发布需在仓库 Marketplace 标签页点击 Publish（需已验证的发布者身份）。

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates multi-provider coding tasks using AI models like Anthropic’s Claude. It allows users to interact with GitHub and Forgejo projects via @-mentions, review pull requests, and implement issues on any supported model, providing a seamless integration into various CI workflows.

What’s Changed

What’s Changed

• chore: version packages by @github-actions[bot] in https://github.com/louisescher/crabd/pull/42

Full Changelog: https://github.com/louisescher/crabd/compare/v1.0.0...v1.0.1

• This action is used across all versions by 1 repositories.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

MigrationPilot is a GitHub Action that analyzes PostgreSQL migration SQL files to ensure they adhere to best practices and are free of common issues. It checks 112 rules, including locking behavior, query timeouts, and index creation methods, ensuring migrations are safe before merging into the main branch. The action outputs detailed reports with violation summaries and suggestions for improving the migration scripts.

What’s Changed

• build(action): bundle dist/action for v1.6.1 (bab9820)
• test(enterprise): pin homedir so the auth tests are hermetic on clean CI (fd9cc4a)
• chore(site): regenerate the hero fixture for 1.6.1 (d91e66b)
• bench: v1.6.1 catches the invalid-index retry (u13) — 31/33 strict, regenerated on a quiet machine (c602273)
• chore: v1.6.1 — version cascade, changelog, cli-reference completeness, refreshed benchmark numbers (2dede01)
• test: regenerate snapshots for the merged engine (1051c50)
• merge: close the last-mile gaps a first user hits — pre-commit, schema, simulate, the safe-index recipe (288eb97)
• merge: the Action survives a read-only token, and the report a reviewer can act on (b9c9842)
• docs: the seven commands the CLI reference never mentioned (4553851)
• fix(cli): stop offering to silence the criticals that just fired (0266c83)

• This action is used across all versions by 5 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the setup of MLIR and provides installation scripts for local use, allowing users to easily integrate MLIR into their workflows. The action includes options to specify LLVM versions or commit hashes and install debug builds on Windows. It also supports automated downloads and decompression using a platform-specific zstd binary, ensuring compatibility across different systems without requiring additional dependencies.

What’s Changed

👀 What Changed

Please refer to the changelog for a structured overview of the changes.

🐛 Bug Fixes

• 🐛 Load the remote version manifest from main (#230) (@denialhaag)

📄 Documentation

• 🔖 Prepare release of v1.4.2 (#231) (@denialhaag)
• 👷 Update known versions for 2026.08.11 (#229) (@mqt-app[bot])
• 👷 Update known versions for 2026.07.13 (#214) (@mqt-app[bot])

🤖 CI

• 👷 Update macOS runners (#232) (@denialhaag)

⬆️ Dependencies

Full Changelog: https://github.com/munich-quantum-software/setup-mlir/compare/v1.4.1...v1.4.2

• This publisher is shown as ‘verified’ by GitHub.

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the communication between GitHub workflows and an OpenText Core Software Delivery Platform (formerly ALM Octane/ValueEdge) through CI/CD. It monitors workflow runs, updates them in the product, and can handle BDD test results and debugging information. The action supports both unidirectional and bidirectional communication with the product, requiring specific API access roles for higher versions.

What’s Changed

v26.4.0

• Introduced a deployment lock mechanism to prevent duplicate workflow runs when multi-job upstream workflows trigger the integration multiple times.
• The integration now uses GitHub Deployments as atomic locks to ensure only one workflow processes each upstream workflow run, preventing duplicate CI events in the product.
• Added SDP_ENABLE_DEPLOYMENT_LOCK environment variable (enabled by default) to control this feature. Set to false to disable duplicate run protection if needed.
• Added comprehensive documentation for the duplicate workflow run protection feature in the README.

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Test-Guard automates the task of checking if a pull request has adequate tests. It evaluates every source file in the PR independently, using diff coverage and heuristic test-file matching to determine if changes are tested. The action provides detailed per-file analysis and uses AI-powered evaluation to ensure comprehensive testing coverage.

What’s Changed

A red gate that measured nothing

On a pull_request run whose GITHUB_REF is not refs/pull/<number>/merge, the action aborted before Layer 1 ran:

::error::Could not determine PR number from GITHUB_REF.

Exit 1, no coverage read, no diff examined — but the check goes red, which from the author’s side is indistinguishable from a test-adequacy verdict.

It reproduces on the edited activity type. Editing a PR body produces a fresh run, and that run can arrive with the ref pointing somewhere other than the merge ref. Since GitHub surfaces the latest run per check name, the result was a red required gate on a commit whose earlier run had passed.

The fix

.pull_request.number is present in every pull_request payload, for every activity type. GITHUB_REF carries the number only while GitHub has a merge ref to point the run at.

The action now reads the payload at GITHUB_EVENT_PATH first and keeps GITHUB_REF as the fallback, so every case that worked before still works. An unusable payload — absent, unreadable, malformed, for another event, or with a number that is not an int — yields no number rather than an exception, leaving the fallback its chance. That last case is not hypothetical: true is valid JSON where the number goes, and bool subclasses int, so a naive check would pass True downstream as PR number 1.

The error message, when neither source yields a number, now names both sources and states outright that nothing was measured.

Upgrading

Nothing to change. v2 now points here.

12 tests added (455 in the suite), ruff clean, and each of the four ways to break the change was verified to turn the suite red.

Full detail in #6.

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The codemetrics GitHub Action automates the computation and gating of cyclomatic and cognitive complexities across multiple programming languages. It allows users to set complexity thresholds for pull requests, ensuring that changes do not exceed these limits, thereby maintaining code quality standards. The action uses a pre-built binary for simplicity and runs on any platform, with support for Go and 16 other languages through the tree-sitter backend.

What’s Changed

Changelog

Others

• e15c21b544b5f2bf7a59a4e05e82dad09331f09e: chore(deps): Bump github.com/odvcencio/gotreesitter (#36) (@dependabot[bot])
• 96daef2859f368a28eb192237a6635be28dc5b28: chore(site): sync gloam assets to 43b9fc8ccd66aa58f25adc74c6b83ab0f8647782 (#35) (@github-actions[bot])

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action prints “Hello World” or a personalized greeting to the log. It solves the problem of automatically greeting people in automated workflows and automates tasks that require basic text output. The key capabilities include setting a custom greeting name and retrieving the current time during execution.

What’s Changed

• My first action is ready (5619594)
• Initial commit (2a56a2a)

• This action is used across all versions by 2 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

本 GitHub Action 是一个用于定时创建腾讯云轻量应用服务器快照的工具。它支持设置每天特定时间自动执行快照，并提供手动触发功能。通过使用 GitHub Secrets 存储敏感信息，确保密钥的安全性。用户可以选择循环模式保留 2 个自动创建的快照或固定模式保留 1 个手动创建的快照和 1 个自动创建的快照。

What’s Changed

• chore: 更新依赖项 (1d0ace9)
• docs: 更新 LICENSE 文件的版权年份 (aa75892)
• docs: 添加项目说明文件 (7109414)
• docs: 添加 Actions 执行截图 (0cebbf0)
• docs: 添加赞赏码图片 (b7be2dd)
• feat: 添加元数据文件 (2ad9cc0)
• feat: 添加核心文件和构建后的文件 (ed923c2)
• build: 添加项目清单文件 (38a3e01)
• chore: 添加格式配置文件 (c905d76)
• chore: 添加忽略配置文件 (34ea98e)

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 16.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action uses Amazon Bedrock Agent to analyze files in pull requests, providing AI-powered feedback. It supports custom prompts, memory management, and integrates with Amazon Bedrock Knowledge Bases for enhanced context-aware insights. The action is customizable and suitable for various use cases beyond code review, including security assessments and performance optimizations.

What’s Changed

What’s Changed

• Support push events by @severity1 in https://github.com/severity1/custom-amazon-bedrock-agent-action/pull/29
• Support push events by @severity1 in https://github.com/severity1/custom-amazon-bedrock-agent-action/pull/30
• Support push events by @severity1 in https://github.com/severity1/custom-amazon-bedrock-agent-action/pull/31

Full Changelog: https://github.com/severity1/custom-amazon-bedrock-agent-action/compare/v0.9.0...v0.10.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Sherpa.sh is an AI-driven tool that simplifies cloud infrastructure management by automatically creating and configuring resources based on user prompts. It automates deployment, eliminating the need for complex YAML files or DevOps expertise, while providing a plain English interface for developers to describe their requirements. The action supports various cloud providers and frameworks, offering features such as server configuration, DNS management, load balancing, CDN setup, and more.

What’s Changed

AI-powered deployments in plain English

Sherpa transforms any cloud provider into a deployment platform. Just describe what you want and let the AI handle the infrastructure.

prompt: “Deploy my Next.js app on AWS Lambda with CloudFront CDN”

Highlights

• Plain English Infrastructure - No YAML configs, no Terraform, no DevOps expertise required
• Multi-Cloud - AWS and Cloudflare supported, with more providers coming
• GitHub Actions Integration - Push-to-deploy workflows with memory persistence
• Claude Code CLI Support - Test locally before committing

Supported Features

Quick Start

- uses: sherpa-sh/sherpa-action@v1.0.0-alpha
  with:
    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
    prompt: "Deploy my app to Cloudflare"
  env:
    CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

Alpha Notice

This is an early release. Expect breaking changes and rough edges. We'd love your feedback—please https://github.com/sherpa-sh/sherpa-action/issues or https://discord.com/invite/Pn7N2Wwbjy.

• This action is used across all versions by 14 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

GitHub Action to automatically tag merge commits with Semantic Versioning 2.0.0-compliant Git tags, handling commit messages for major, minor, and patch bumps, supporting Conventional Commits, pre-releases, and floating reference tags. The action can be configured to skip certain branches or use branch name fallbacks for versioning.

What’s Changed

🐛 Bug Fixes

• handle pull request heads safely (#16) (356127a)
• require bats for full suite (#15) (5b693a4)
• parse Conventional Commit headers only (SO1-266) (#14) (ceac5b8)
• publish tags atomically (#13) (12902d5)
• preserve inline prerelease suffixes (SO1-265) (#12) (d8d7d99)
• validate prerelease suffixes (SO1-263) (#11) (554cac9)
• validate bump configuration (#10) (b043d9c)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action replaces placeholders in a configuration file with values from environment variables. It’s designed to automate the process of dynamically setting configurations based on environment settings, making it easier to manage and deploy applications across different environments.

What’s Changed

• feat: Initial version (e440a96)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

SSG is a static site generator written in Go that converts Markdown content with YAML frontmatter into a fully functional website. It supports various features such as templates, Sitemap and SEO metadata, webP conversion, and deployment to platforms like GitHub Pages and Netlify.

What’s Changed

Installation

Quick Install (Linux/macOS)

curl -sSL https://raw.githubusercontent.com/spagu/ssg/main/install.sh | bash

Package Managers

• Homebrew: brew install spagu/tap/ssg
• Snap: snap install ssg
• Debian/Ubuntu: Download .deb file below
• Fedora/RHEL: Download .rpm file below

Checksums

See checksums.sha256 for file verification.

📖 Full documentation: https://github.com/spagu/ssg#readme

What’s Changed

• 1.8.29 — fix(#114): snap bundles wpexporter so ssg migrate works by @spagu in https://github.com/spagu/ssg/pull/124

Full Changelog: https://github.com/spagu/ssg/compare/v1.8.28...v1.8.29

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action integrates GitHub Classroom assignments with Google Sheets, automatically sending results to a specified Google Sheet. It allows teachers to track assignment grades and provide feedback directly within their Google Sheets. The action requires setting up Google Sheets API credentials and configuring secrets for authentication. Users can update the Google sheet structure by defining column names in their workflow.

What’s Changed

First working version with basic functionality

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Sverklo is an open-source local-first Memory Control Plane (MCP) server designed to enhance coding agent productivity by providing context and insights into the codebase. It helps agents make informed decisions by offering symbols, callers, diffs, blast radius, and git-pinned decisions before editing. Sverklo supports multiple language models and integrates with popular coding tools like Claude Code, Cursor, Windsurf, Codex CLI, and any MCP-speaking agent. The action automates the process of generating context for agents to improve their performance by providing a detailed view of the codebase without modifying it.

What’s Changed

• chore(release): v0.29.5 (b0a7b81)
• fix: prioritize matched path definitions (ff68633)
• chore(release): v0.29.4 (077fc57)
• fix: harden proof receipt caller evidence (0e5af34)
• chore(release): v0.29.3 (fd90c18)
• fix: make proof feedback privacy-safe (c284435)
• docs: surface latest proof receipt (3156eff)
• 0.29.2 (58f82b8)
• feat(search): emit bounded budget requests (48b9857)
• feat(search): explain result enoughness (87217bd)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the build process for Wails.io v3 projects. It installs GoLang and NodeJS, builds the project based on specified platforms, and optionally obfuscates the binary before uploading results to GitHub. On tagged builds, it also uploads the release artifacts to the release section. The action supports various configuration options for building and packaging the application.

What’s Changed

Full Changelog: https://github.com/ToQuery/wails3-build-action/compare/v3-alpha.9...v3-alpha.9

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Vaara is a Python library that provides verifiable receipts for autonomous actions, ensuring accountability and trust in decision-making processes. It automates the process of verifying and auditing autonomous actions by providing secure logging and evidence storage, which can be used to prove the outcomes of actions and maintain traceability of all activities within an organization.

What’s Changed

[1.66.2] - 2026-08-12

Fixed

• The documented way to use the action did not work. The README and docs/github-action.md tell consumers uses: vaaraio/vaara@v1, which is the GitHub Actions convention, but no v1 tag existed. Anyone copying that line got “unable to resolve action vaaraio/vaara@v1”. A floating v1 tag now exists and moves with each release.
• The release workflow triggered on v*, which would have fired it for the floating v1 tag, derived version “1”, and failed looking for a changelog entry that cannot exist. It now triggers only on full version tags.
• One example in docs/github-action.md pinned v1.65.0, a release that predates the action existing.

Changed

• The action’s display name is now “Vaara Policy Check”. This is the title GitHub Marketplace shows. The listing URL is unaffected.

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates PR triage by reading open pull requests, identifying potential blockers, and labeling them with relevant information. It helps maintainers quickly understand which PRs are worth addressing and provides detailed guidance to contributors on what needs improvement. The bot never merges any PRs, leaving the final decision up to the maintainer.

What’s Changed

• Merge pull request #54 from wagmiiii/feat/sweep-performance-optimizations (b372a50)
• chore: rename action to Maintainer PR Triage Bot for marketplace uniqueness (104f69a)
• Merge pull request #52 from wagmiiii/feat/sweep-performance-optimizations (4bc3a2d)
• fix: read github-token from action inputs to fix missing token error (cc3e84f)
• fix: bundle action as cjs to prevent dynamic require error (9a167e3)
• Merge pull request #53 from wagmiiii/feat/pr-110-user-gate (cca7ede)
• style: fix prettier formatting issues (4bddd3b)
• docs: file PR-086, and put PR-110 on the board as the only open question (a1e9219)
• fix: mock checks collection in tests and update dist (8245a3e)
• chore: add self-dogfooding workflow (bca4e46)

• This action is used across all versions by 0 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the validation of HTML email templates against Can I Email, a dataset of supported features and accessibility standards. It supports multiple interfaces including CLI, Java DSL, GitHub Action, Maven Central/GitHub Packages, and Docker image, providing JSON/XML/HTML/Markdown reports. The action can be used to validate inline HTML, files, stdin, or URLs and includes an optional BFSG accessibility audit using Playwright and axe-core.

What’s Changed

What’s Changed

• ci: standardize native release pipeline by @YunaBraska in https://github.com/YunaBraska/email-html-validator/pull/17
• ci: use corrected native workflow by @YunaBraska in https://github.com/YunaBraska/email-html-validator/pull/18
• ci: use corrected native asset workflow by @YunaBraska in https://github.com/YunaBraska/email-html-validator/pull/19
• ci: use Windows-ready native workflow by @YunaBraska in https://github.com/YunaBraska/email-html-validator/pull/20
• ci: simplify release asset flow by @YunaBraska in https://github.com/YunaBraska/email-html-validator/pull/21
• ci: map Central publish secrets by @YunaBraska in https://github.com/YunaBraska/email-html-validator/pull/22
• fix: skip arm64 QEMU browser smoke test by @YunaBraska in https://github.com/YunaBraska/email-html-validator/pull/23
• ci: publish delivery channels in parallel by @YunaBraska in https://github.com/YunaBraska/email-html-validator/pull/24
• ci: align native build matrix by @YunaBraska in https://github.com/YunaBraska/email-html-validator/pull/25
• ci: reuse native Docker assets by @YunaBraska in https://github.com/YunaBraska/email-html-validator/pull/26
• ci: allow Docker artifact downloads by @YunaBraska in https://github.com/YunaBraska/email-html-validator/pull/27

New Contributors

• @YunaBraska made their first contribution in https://github.com/YunaBraska/email-html-validator/pull/17

Full Changelog: https://github.com/YunaBraska/email-html-validator/compare/2026.06.1562143...2026.8.12

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Garita is a GitHub Action that prevents sensitive personal information and credentials from entering a repository. It checks for common identifiers such as CURP, RFC, CLABE, and phone numbers to ensure they are not included. Garita uses a single configuration file to specify which sensitive data should be blocked, making it easy to maintain and update without needing to modify the Git history.

What’s Changed

El README prometía que «un identificador con dígito verificador no valida fuera de su país, así que no dispara». Es cierto entre familias distintas y falso dentro de una misma. Medido antes de tocar nada:

El reporte emitía dos hallazgos sobre el mismo número, cada uno afirmando una nacionalidad distinta con la misma seguridad. Las dos no pueden ser ciertas, y quien lee no tiene cómo saber cuál lo es.

Qué se hizo

La información para desambiguar no está en el número, así que no hay arreglo que la deduzca. Lo que sí se puede es dejar de fingir que la hay: cuando dos países reclaman el mismo valor en la misma línea se emite un hallazgo, con los candidatos nombrados y con el camino para volverlo inequívoco (paises:). Se conserva el de mayor severidad y, a igualdad, el primero por nombre de detector, para que la línea base y el SARIF sigan casando entre corridas.

La promesa falsa estaba en tres lugares —README, paises/__init__.py y Config.paises— y los tres quedaron corregidos con los porcentajes medidos.

Lo que casi sale mal

La regla exige países distintos, y no es un detalle: la primera versión agrupaba por (archivo, línea, valor recortado) a secas, y al medirla contra un repositorio real se comió un RFC. El valor va recortado, así que el CURP y el RFC de una misma persona —que empiezan igual y pueden terminar igual— compartían clave. Dos documentos del mismo país no se contradicen: se suman.

Verificación

322 pruebas, cuatro de ellas de contrapeso. Medido contra siete repositorios reales, incluidos los cuatro consumidores del tag v0: reportes byte a byte idénticos.

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action is designed to set or update the version of a package in your project. It automates the process of updating package versions, which is useful for version control and dependency management. The action provides a simple interface to specify the new version number, allowing you to streamline release processes and ensure consistent versioning across different environments.

What’s Changed

• Initial Release

• This action is used across all versions by 2 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Release Pilot is a GitHub Action that simplifies the release process by automating semantic versioning, tagging, changelog generation, and GitHub Release creation. It uses Conventional Commits parsing to determine the next SemVer version, supports breaking changes with ! footers, and provides features like pre-release support, floating major/minor tags, and Node.js 24+ ESM compatibility. It offers a zero-config approach for users who want a single action to handle all release tasks.

What’s Changed

🐛 Bug Fixes

• Update versions due to audit issues (256256f)
• Group codeql-action Dependabot updates to avoid version mismatch failures (#61) (77721a3)

📦 Build

• deps: bump pnpm/action-setup from 6.0.9 to 6.0.10 (19b8194)
• deps: bump actions/stale from 10.4.0 to 11.0.0 (0c7aa83)
• deps: bump github/codeql-action/analyze from 4.37.2 to 4.37.6 (38344e7)
• deps: bump github/codeql-action/init from 4.37.3 to 4.37.6 (5752358)
• deps: bump github/codeql-action/autobuild from 4.37.2 to 4.37.6 (da26806)
• deps: bump github/codeql-action/autobuild from 4.37.0 to 4.37.2 (00fc662)
• deps: bump github/codeql-action/analyze from 4.37.0 to 4.37.2 (c0687f2)
• deps: bump github/codeql-action/init from 4.37.0 to 4.37.3 (5b4270f)
• deps: bump actions/checkout from 7.0.0 to 7.0.1 (737824f)
• deps: bump actions/setup-node from 6.4.0 to 7.0.0 (2fafde6)
• deps: bump actions/stale from 10.3.0 to 10.4.0 (fe5be85)
• deps: bump pnpm/action-setup from 6.0.8 to 6.0.9 (f4daeb1)
• deps: bump github/codeql-action from 4.36.1 to 4.36.2 (7cca48c)

🧹 Chores

• versions (3985847)
• versions (d947a61)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

file-search-on is a versatile file search tool that uses CEL expressions to filter files based on metadata and content-type-specific attributes. It supports multiple file formats and provides comprehensive extraction of metadata, making it suitable for various use cases such as searching documents, images, and videos by specific criteria. The tool is built in the open and welcomes contributions.

What’s Changed

Changelog

Others

• 9248e4dc4ce9056979d6c20ea876caea6445671e chore(deps): Bump modernc.org/sqlite in the minor-and-patch group (#569)
• 34a18fba2f2922090b921b2f070376db634bbb44 chore(deps): bump codemetrics to v0.12.5, treesitter-symbols to v0.6.5
• 39243f9c148c25f8b34135c47c4ce1dc45b89845 chore(site): sync gloam assets to 43b9fc8ccd66aa58f25adc74c6b83ab0f8647782 (#568)

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action prints a greeting message to the log, with an optional parameter for the name of the person to greet. It uses Docker to run a container and provides an output for the current time.

What’s Changed

Full Changelog: https://github.com/RivieraKid/gha-kaniko/compare/v1...v0.0.1

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Summary: This GitHub Action, named piayn, automates the management of pull requests (PRs) across multiple branches to enable AI code review tools to process code directly from private branches. It ensures that PRs are open solely as review surfaces and are automatically retired when a branch is merged, deleted, or goes quiet.

What’s Changed

Full Changelog: https://github.com/sandys/pr-is-all-you-need/compare/v1.0.0.1...v1.0.0.2

• This action is used across all versions by 29 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action processes various test reports generated by Maven Surefire, Failsafe, Gradle, Pytest, and Go, publishing the results as either a GitHub check run or workflow-native annotations with a job summary. It supports migration from v1 to v2 with improved default behavior for certain events and new capabilities like workflow-native reporting.

What’s Changed

Changes

🐛 Fixes

• chore(deps): update all dependencies @ghaiszaher (#38)
• chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 @dependabot[bot] (#31)
• chore(deps): bump actions/setup-java from 5 to 5.6.0 @dependabot[bot] (#36)
• chore(deps): bump actions/stale from 10 to 11 @dependabot[bot] (#35)
• chore(deps-dev): bump nock from 14.0.15 to 14.0.16 @dependabot[bot] (#26)
• chore(deps-dev): bump @types/node from 26.0.0 to 26.1.0 @dependabot[bot] (#30)
• chore(deps): bump release-drafter/release-drafter from 7.4.0 to 7.5.1 @dependabot[bot] (#24)

📦 Dependencies

• chore(deps): update all dependencies @ghaiszaher (#38)
• chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 @dependabot[bot] (#31)
• chore(deps): bump actions/setup-java from 5 to 5.6.0 @dependabot[bot] (#36)
• chore(deps): bump actions/stale from 10 to 11 @dependabot[bot] (#35)
• chore(deps-dev): bump vitest from 4.1.9 to 4.1.10 @dependabot[bot] (#34)
• chore(deps-dev): bump nock from 14.0.15 to 14.0.16 @dependabot[bot] (#26)
• chore(deps-dev): bump @types/node from 26.0.0 to 26.1.0 @dependabot[bot] (#30)
• chore(deps): bump release-drafter/release-drafter from 7.4.0 to 7.5.1 @dependabot[bot] (#24)
• chore(deps): bump release-drafter/release-drafter/autolabeler from 7.4.0 to 7.5.1 @dependabot[bot] (#25)

Full Changelog: https://github.com/ScalableCapital/action-surefire-report/compare/v2.0.4...v2.0.5

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the linting process using the Mordant library, which helps developers identify potential issues in their code. It builds Mordant against nightly pins and runs it over the workspace, providing findings annotated on the pull request diff, within the job log, and in the job summary. The action can fail if there are any findings or can run without failure based on user settings.

What’s Changed

• Runs Mordant lints against any Rust workspace
• Needs no Cargo.toml change
• Annotates findings on the pull request diff
• Tabulates every finding in the job summary
• Exits non-zero on the first finding
• Caches the driver, library, and dylint binaries
• Reads dylint.toml, including the ratchet baseline

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 16.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action leverages Amazon Bedrock Agent to analyze files in a pull request (PR) using customizable prompts and integrates with Amazon Bedrock Knowledge Bases for context-aware insights. It provides tailored analysis, flexible use cases, and seamless integration into the PR process, enhancing code quality, security assessments, and performance optimizations.

What’s Changed

What’s Changed

• 21 closing pr should end agent session by @severity1 in https://github.com/severity1/custom-amazon-bedrock-agent-action/pull/27

Full Changelog: https://github.com/severity1/custom-amazon-bedrock-agent-action/compare/v0.8.0...v0.9.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Sherpa.sh is an AI that automates the deployment of applications across various cloud providers. It simplifies the process by allowing developers to describe their infrastructure needs in plain English, and Sherpa figures out how to configure and deploy it automatically. This tool reduces the need for manual configuration and expertise in DevOps, making it easier for developers to ship products efficiently.

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Shipi18n GitHub Action automatically translates i18n locale files using your own LLM, providing an open-source solution for translating without a Shipi18n account or hosted API. It supports incremental mode and allows you to skip keys or paths during translation, while also verifying placeholder preservation and key consistency. The action can output translated files, verification errors, warnings, and skipped keys count.

What’s Changed

v2 drops the hosted Shipi18n API. The action now calls your own OpenAI or Anthropic key directly — no Shipi18n account, no API key, no per-word fees.

- uses: Shipi18n/shipi18n-github-action@v2
  with:
    source-file: locales/en.json
    target-languages: es,fr,de
    provider: anthropic          # or openai
    api-key: ${{ secrets.ANTHROPIC_API_KEY }}

Breaking changes

• The Shipi18n api-key / api-url inputs are gone. Pass provider plus your own LLM key (or set ANTHROPIC_API_KEY / OPENAI_API_KEY in the job env).
• Hosted LLM verification, self-correction and dashboard sync are removed. Local verification (placeholder, key and length checks) is kept.
• The YAML locale-file input is removed; JSON only.

Added

• provider, model inputs — Anthropic (default) or OpenAI, with an optional model override.
• Local skip-keys / skip-paths glob matching.
• Built on the new open-source @shipi18n/core engine, which is now bundled into dist/ along with the provider SDKs.

Source for v2 lives in the Shipi18n/shipi18n monorepo; this repo remains the release mirror, so @v2 keeps working with no path change.

• This action is used across all versions by 2 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Smyklot is a GitHub App that automates pull request approvals and merges based on the .github/CODEOWNERS file. It allows repository owners to approve or merge PRs by commenting with specific commands or reactions, ensuring only authorized users can perform these actions. The app supports multiple formats for command submission and provides features like reaction-based approval, merge method control, and automated cleanup of bot interactions.

What’s Changed

1.23.1 (2026-08-12)

Smyklot v1.23.1

Docker image: ghcr.io/smykla-skalski/smyklot:1.23.1

Changelog

• a19b159aa070b16b36a3eb882bfcfd76d2f7fb69 chore(release): bump version to 1.23.1
• 8c1dc00e76e553c2e35019266a409338a09988bc fix(ci): use GitHub App client ID (#190)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action reads values from environment variables and replaces placeholders in specified configuration files. It automates tasks like updating configuration settings dynamically based on runtime conditions, ensuring consistency across environments.

What’s Changed

• feat: Add support for .env files (e706be3)
• chore: More info (d440258)
• feat: Initial version (e440a96)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The deploy-swarm-service GitHub Action automates the deployment of a service to a Docker Swarm cluster. It performs two main tasks: running npm ci and bundling the project, then committing the resulting dist directory. This ensures that only necessary changes are pushed to the repository, reducing unnecessary uploads and improving deployment efficiency.

What’s Changed

• feat: Update to latest Docker version (6435c1d)
• feat: Explicitly set traefik inbound network (70d83f9)
• feat: Automatically set placement preferences based on placement constraints to spread containers of a service across nodes (51af2c2)
• feat: Add support for depends_on (688c023)
• feat: Add support for service labels (a36e5ea)
• fix: Fix restart policy to always restart because containers sometimes exit with code 0 even though they had an error (01b34f4)
• feat: Add support for multiple external routes (d99208c)
• feat: Improve update config (3c87f67)
• feat: Add support for mounts, max replicas per node and stop signal and grace period (90fa02a)
• feat: Add support for resource limits and reservations (b33b12f)

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action integrates with Google Sheets to automatically send assignment results from GitHub Classroom. It enables the following functionality:

1. Integration: Automatically updates a Google Sheet with students’ grades and additional information.
2. Task Results: Supports multiple tasks by dynamically adjusting column names based on task IDs specified in the workflow.
3. Column Management: Handles the creation of new columns for tasks that are not yet present in the sheet.
4. Security: Uses service account credentials to ensure secure access to the Google Sheets API.

Key Capabilities

• Automatically updates assignment results in a Google Sheet.
• Supports multiple tasks by dynamically adjusting column names.
• Creates new columns and rows as needed based on task IDs specified in the workflow.
• Securely integrates with Google Sheets using service account credentials.

What’s Changed

• Updated comments (bf17880)
• Updated .dockerignore (498a6f7)
• Updated readme (bbb6b5a)
• Changed dockerfile to docker pull (8c8584b)
• Changed dockerfile to docker pull (23fa131)
• Fixed inputs (844c583)
• Merge pull request #5 from SPGC/using-result-base64-string (042d99f)
• Fixed input name (92dd201)
• Merge pull request #4 from SPGC/using-result-base64-string (79dad97)
• Code cleanup and fix bug with empty env variables (b474731)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Sverklo is an open-source local-first Memory and Context Provider server designed to enhance coding agents by providing them with contextual information such as symbols, callers, diffs, blast radius, and git-pinned decisions before they edit. It allows users to use Sverklo when their agent needs relationships before editing or when they know the exact string. The action is particularly useful for large codebases where writing and running scripts can be time-consuming.

What’s Changed

• chore(release): v0.29.4 (077fc57)
• fix: harden proof receipt caller evidence (0e5af34)
• chore(release): v0.29.3 (fd90c18)
• fix: make proof feedback privacy-safe (c284435)
• docs: surface latest proof receipt (3156eff)
• 0.29.2 (58f82b8)
• feat(search): emit bounded budget requests (48b9857)
• feat(search): explain result enoughness (87217bd)
• docs: clarify proof-first fit (7c7d1a2)
• docs: add proof-run feedback template (c3628e4)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the process of generating a README file for your project by creating a simple template. It solves the problem of maintaining updated README files manually and provides key capabilities for customizing and enhancing the content with additional information, contributors, or links.

What’s Changed

初始发布，支持打招呼

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The compose-lint action is a security-focused linter for Docker Compose files that catches dangerous misconfigurations before they reach production. It automates the process of identifying and fixing common security vulnerabilities in docker-compose.yml and compose.yaml files, such as privileged containers, unpinned images, host-network sharing, sensitive bind mounts, hard-coded credentials, and more. The action provides a full rule documentation at tmatens.github.io/compose-lint for reference.

What’s Changed

Upgrading from 0.16.x

Four capabilities that passed on 0.16.0 now fail; nothing else moved. SYS_NICE, IPC_LOCK and LEASE are flagged by the new CL-0029, and SYSLOG by the new CL-0030 — all four at HIGH, and all four ungraded on 0.16.0, where no rule covered them.

Unlike 0.15.x → 0.16.0, no existing finding changes rule or severity, so a waiver written against 0.16.0 still covers what it named. The only new suppressions you may need are for the four capabilities above.

Added

• CL-0029 — host-availability capability added (HIGH): flags cap_add of SYS_NICE, IPC_LOCK or LEASE. Each reaches the host with nothing else in the file and costs availability alone — SYS_NICE puts the container’s threads above every ordinary host process on a scheduler that is not namespaced, IPC_LOCK pins host RAM past RLIMIT_MEMLOCK that cannot be reclaimed or swapped, and LEASE stalls the host’s own open() on any bind-mounted path for the kernel’s lease-break timeout. Each member was measured on Docker 29.4.3 holding only that capability under --cap-drop ALL. The fix text points at deploy.resources and at bounding a workload that keeps the capability, since SPDK and DPDK ask for SYS_NICE and IPC_LOCK together.

• CL-0030 — host-disclosure capability added (HIGH): flags cap_add: SYSLOG, which reads the host kernel ring buffer — dmesg is not namespaced, so the container sees the host’s boot, hardware and driver log, including kernel pointers where kptr_restrict allows them. Independence from the host’s kernel.dmesg_restrict was measured rather than assumed: with that sysctl at 0, a capless container still read 0 lines against 2,028 with the capability, because Docker’s default seccomp profile admits syslog(2) only for CAP_SYSLOG. The gate is the capability, on any host.

  With SYSLOG graded, every Linux capability now carries a rule or a recorded reason it needs none — test_rule_membership.py’s ungraded set is empty.

Changed

• CL-0013’s remedy for /dev/shm and /dev/hugepages is now something the reader can actually follow. Both kept firing correctly — a host bind of either exposes segments belonging to the host and every other container — but the guidance said to drop the mount and “use a named volume”, which provides neither facility. It now names the real alternatives, each verified against Docker 29.4.3 rather than taken from documentation: shm_size: for a larger segment, ipc: shareable plus ipc: service: for two services that must share one, and a hugetlbfs volume for huge pages (bounded with deploy.resources.limits, since the pool stays host-wide). A workload that genuinely needs the host’s own huge-page files is told to suppress with a reason rather than pretend the mount is safe. Over the archived 5,417-file corpus this changed 39 fix texts and zero findings.
• CL-0024’s doc now states what the SYS_ADMIN judgment call actually decides, rather than implying a broader choice than the rule makes.
• docs/state-of-compose.md and its four charts are regenerated on a 0.16.0 baseline, so the published corpus figures reflect the current severity model rather than 0.15.x pricing.
• The examples library is refreshed against 0.16.0 — each worked example re-linted so its quoted findings, ids and severities match what the release actually emits.
• The demo GIFs are re-rendered on 0.16.0.
• Rule counts stated in prose are now held to the registry by tests/test_rule_surfaces.py. Four surfaces had gone on claiming 25 rules after CL-0029 and CL-0030 landed — the mkdocs site_description search engines index, the Docker Hub overview that syncs on every default-branch push, SECURITY-EXPECTATIONS.md, and the roadmap inventory — because such counts go stale when a rule lands, not when a version ships, so neither the release checklist nor CI’s version-pin check reached them.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub action automates the build process for Wails.io projects using GoLang and NodeJS. It builds a binary for different platforms, optionally obfuscates it, and can upload the results to GitHub or release on tagged builds. Users can specify various configurations like Go version, Wails version, build name, platform, caching options, and even build Node.js and Deno applications using pnpm and Deno, respectively.

What’s Changed

Full Changelog: https://github.com/ToQuery/wails3-build-action/compare/v3-alpha.14...v3-alpha.14

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Vigilnz Security Scan Action automates security scanning tasks such as SCA, SBOM, SAST, IAC SCAN, SECRET SCAN, DAST, and CONTAINER SCAN on GitHub repositories. It integrates with Vigilnz’s API to perform these scans and provides outputs directly in the GitHub Actions workflow. The action is easy to use, requiring an API key stored securely in GitHub Secrets and adding a simple step to your workflow YAML file.

What’s Changed

• Implement the includes field for folder vise selection scan
• Also added the excludes field for to ignore the folder to scan

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

RustScript is an interpreter that allows running Rust scripts without compiling them. It supports basic Rust syntax and functions like file reading and printing, but does not compile the script to a binary or execute it with Cargo. Instead, it interprets the script in-memory and runs it on a register VM using multi-threaded Tokio runtime. This makes it ideal for quick prototyping or executing small scripts without waiting for compilation.

What’s Changed

Full Changelog: https://github.com/VladasZ/rustscript/compare/v0.3.5...v0.3.6

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the process of syncing a graph using Worai, a tool for managing graph data. It installs Worai and its dependencies, including Playwright and Chromium, and runs the synchronization command. The action supports various options for debugging, logging levels, working directories, and configuration paths. Additionally, it can export graph KPIs to WordLift’s API for analysis.

What’s Changed

What’s Changed

• feat: Trim sync-report artifacts with 7-day retention and filter out kpi json by @numanwordlift in https://github.com/wordlift/graph-sync/pull/8
• chore: bump default worai to 6.20.10 by @ziodave in https://github.com/wordlift/graph-sync/pull/9

Full Changelog: https://github.com/wordlift/graph-sync/compare/v6.11.5...v6.11.6

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action creates an open-source contribution banner based on contributions made to other people’s repositories, measuring and displaying stats such as merged PRs, reviews given, projects contributed to, and issues resolved. It supports both SVG and PNG formats and can be configured with various options like theme, format, output path, and tile rendering. The action automates the process of updating a GitHub profile README with this contribution banner, ensuring it reflects your contributions across repositories efficiently.

What’s Changed

Full Changelog: https://github.com/yashksaini-coder/GitBanner/compare/v1.2.0...v1.2.1

• This action is used across all versions by 84 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the process of running npm audit fix and creating a pull request to fix security vulnerabilities in Node.js projects. It helps maintain secure dependencies and enhances project stability by addressing potential issues found during an audit. The action is configured through YAML files and supports various inputs for customization, such as branch creation, commit message, labels, assignees, and npm arguments.

What’s Changed

See the changelog for details.

Compare: https://github.com/ybiquitous/npm-audit-fix-action/compare/v7.3.11...v8.0.0

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 16.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

B.IA is a GitHub Action that automates accessibility checks in CI/CD pipelines. It allows companies to define an audience and the percentage of WCAG guidelines they must meet, ensuring their code complies with accessibility standards before acceptance into production. This tool streamlines the process by using AI to analyze guidelines more effectively than manual methods, helping teams focus on improving specific audiences’ accessibility needs.

What’s Changed

• Update geminiService.ts (688e09b)
• Update README.md (dbe3d74)
• Update README.md (0f117a4)
• Update README.md (45026e8)
• Merge pull request #2 from YuriFAToledo/documentation (04a0849)
• Update README.md (8bb0621)
• Update README.md (efeffcc)
• feat: add pr flow (2bf86c4)
• feat: new gemini properties (0d597b1)
• fix: enforce properties at gemini json (313ff7b)

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The GitHub Action uses a tagged template to provide consistent, safe, and explicit ways to run process commands with sensible defaults such as throwing on failure, capturing output, and ensuring security by preventing injection attacks. It ensures that all processes are executed with default options, making it easy to maintain and use across different projects without needing to configure each call individually.

What’s Changed

2.0.0 (2026-08-12)

⚠ BREAKING CHANGES

Note: the v2 API is source-compatible with 1.x — no code changes are required to upgrade. The major version marks the new review model: conventions-aware, adversarially verified, discussion-driven review with an injection-hardened comment channel, replacing the per-push diff score.

• ai: discussion-driven review with adversarial verify and deeper context (#334)

Features

• ai: discussion-driven review with adversarial verify and deeper context (#334) (3002b69)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action is a static website validator that performs recursive link checking, markup validation of HTML, SVG, and MathML documents, checks multiple websites with a single configuration file, supports persistent response caching, concurrency, rate limits, retries, robots.txt, and sitemap support. It can be installed via Cargo and used to check websites or as part of GitHub Actions workflows.

What’s Changed

Changelog

• 791242ccf6e8590c0f71549709521986e2ca67f8 Bump version (#1245)
• 4c67d05c6c99255a4bbd1fe3042b7163863563f4 Handle empty namespaces (#1235)
• 404042efb53b987ef9f9120d45efd4f9fec2df2d Bump async-trait from 0.1.91 to 0.1.92 (#1244)
• db204770c98b902ff89adc804ff831e506c5b597 Refactor name class members (#1243)
• f58d6af756b278801dae71a85fff0127715a81fa Bump @types/node from 26.1.2 to 26.2.0 in /doc (#1238)
• 33bdcb33c78b62acbd60eee9e844a42c14a82bbe Bump swatinem/rust-cache from 2.9.1 to 2.9.2 in /.github/actions/setup (#1242)
• d28d3c191a6ae0b301292813aee3c0c05147f411 Bump codspeedhq/action from 5.0.2 to 5.0.3 (#1241)
• abda60558362e69eed403cb064815935e39dea91 Bump homebrew/actions/setup-homebrew from 2026.08.03.2 to 2026.08.10.1 (#1240)
• b259455bcafae43b0b1f03f50689770bcafa1473 Bump vendor/validator from 1fd9e8b to 1cf9f1b (#1239)
• 6fbafe906a9e8a4a5434ad90fc7a5b35d4d2e7bd Bump clap from 4.6.5 to 4.6.6 (#1236)
• 16d34c4772e04d46740eb1a0f96d68e59dc99660 Bump the astro group in /doc with 2 updates (#1237)
• 45d656c31f9a8c7060e84e54c15218582b7fef9b Fix duplicate elements on SVG validation (#1229)
• 8ad1593f1734a4f9f7d3fe761b2f3ad929d36dbe Bump pnpm/action-setup from 6.0.9 to 6.0.10 in /.github/actions/setup-document (#1234)
• 7d3c53f0b05498bbb12ceb3a7e7735c226fe9354 Bump @biomejs/biome from 2.5.6 to 2.5.7 in /doc (#1231)
• a5972daaed5a0ad1fb33870b372c6a3e83f76984 Bump homebrew/actions/setup-homebrew from 2026.08.03.1 to 2026.08.03.2 (#1233)
• e1a3701288f1ef50d19c17e9068ca0c054622a73 Bump vendor/validator from 372674c to 1fd9e8b (#1232)
• 9a1efcb5014831b9c0418a853f73aeb1bb723f90 Add TODO comment on attribute repetition semantics (#1230)
• 1585e1477c4bfc82f308d40eaa8164938a459401 Fix double lang attributes (#1228)
• 0972cf23ef0530b19f42bd39d035bd82cf5ed525 Fix xml:id match (#1227)
• b3fa2973142b02688cd52606398dd7da5063d723 Check root element in SVG (#1226)
• 57d490d55eb8217c9156ad89eeec61c89af09358 Link stale-while-revalidate semantics (#1225)

• This action is used across all versions by 2 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Outrider GitHub Action: Automates the creation of draft pull requests (PRs) with detailed implementation notes and evidence of compliance. The action supports various trigger patterns such as alerts, search queries, pinned papers, or design briefs, ensuring that each PR is reviewed thoroughly by automatically generating a self-review section and checking for references cited, license flags, tests, convention alignment, and scope discipline. The action uses multiple backends like Anthropic Opus and z.ai GLM-5.2 to optimize the recommendation process.

What’s Changed

Harden the agent runtime against prompt injection and GitHub-token leakage.

• Capability cut: PreToolUse Bash deny-gate for the spawned agent (package installs, network egress, gh writes, git push).
• Risky-surface signal: route-to-human flag (draft + label + PR note) on dependency-manifest / CI / hook / Dockerfile / *.sh diffs.
• Token handling: token-less clone config, ephemeral push (no set-url persistence), GITHUB_TOKEN withheld from the agent, fail-closed pre-push credential scan.
• Pre-install target deps before the agent runs (CI / INPUT_PREINSTALL).

Full changelog: #119

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action prints a greeting message to the log, either “Hello World” or “Hello [person’s name]”, and provides the current time. It is useful for automating the process of greeting users in automated workflows.

What’s Changed

• My first action is ready (5619594)
• Initial commit (2a56a2a)

• This action is used across all versions by 7 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The rumdl action is a high-performance Rust-based Markdown linter and formatter that provides fast linting, extensive rule coverage, automatic formatting with --fix, and support for multiple markdown flavors. It’s designed to be zero-dependency and highly configurable, making it suitable for use in various environments including Rust, Python, npm, pip, uv, mise, Nix, Termux User Repository, and pacman.

What’s Changed

Added

• action: add a command input to run rumdl fmt (9b59bff)
• action: add install-only input to skip linting (aa0c604)
• MD010: add ignore-code-languages to exempt fence languages from tab checks (21b56d0)

Fixed

• config: honor the markdown attribute on every block-level element (6f88d71)
• links: stop parsing reference links and images inside HTML blocks (8829f6b)
• html-blocks: keep a nested raw-text element from opening its own block (27d96bb)
• code-block-tools: stop a linter in a format slot from overwriting the block (a40d7da)
• code-block-tools: report findings at the line they belong to (31cc6cb)
• code-block-tools: bound a hanging tool by its timeout and stop respawning it (6ce8a1d)
• action: add rumdl to PATH so later workflow steps can call it (98baf60)

Downloads

Installation

Using uv (Recommended)

uv tool install rumdl

Using pip

pip install rumdl

Using pipx

pipx install rumdl

Direct Download

Download the appropriate binary for your platform from the table above, extract it, and add it to your PATH.

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automatically manages multiple pull requests per active branch, enabling AI code review tools to process direct commits to private branches without the need for manual intervention or additional tokens. It keeps draft PRs open as surfaces for review and retires them when branches are merged, deleted, or become inactive. The action uses a single GITHUB_TOKEN for all operations and has no secrets or configuration required.

What’s Changed

Full Changelog: https://github.com/sandys/pr-is-all-you-need/compare/v1.0.0.0...v1.0.0.1

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The sarif-kit GitHub Action converts output from various static analysis tools into valid SARIF 2.1.0 format suitable for GitHub Code Scanning, which requires this specific format for input. It supports linting tools like yamllint and pip-audit, translating their native output into SARIF reports that GitHub can understand, ensuring consistent error reporting across different scanning engines.

What’s Changed

v0.3.0 (2026-08-11)

This release is published under the Apache-2.0 License.

Documentation

• Drop the stale status counts (0f8dcb6)

• Mkdocs site on github pages (8336445)

• Platformio alert screenshot (4344870)

Features

• Pylint adapter (74d2897)

Detailed Changes: v0.2.0…v0.3.0

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Summary: AgentAuditKit is a security scanner designed to scan AI agent pipelines for misconfigurations, hardcoded secrets, tool poisoning, rug pulls, trust boundary violations, and tainted data flows. It runs fully offline and deterministically, ensuring consistent findings across different runs. The action provides auditor-ready compliance-evidence packs in SARIF format and PDF reports, covering 12 security frameworks.

What’s Changed

Installation

pip:

pip install agent-audit-kit==v0.3.73

Docker:

docker pull ghcr.io/sattyamjjain/agent-audit-kit:v0.3.73

GitHub Action:

- uses: sattyamjjain/agent-audit-kit@v0.3.73
  with:
    fail-on: high

Supply chain

• rules.json — deterministic rule bundle
• rules.json.sha256 — trusted digest
• sbom.cdx.json / sbom.spdx.json — CycloneDX + SPDX SBOM
• *.sigstore — Sigstore keyless signatures (verify with agent-audit-kit verify-bundle)

What’s Changed

• Composition-aware capability union, and honest limits on per-skill scanning by @sattyamjjain in https://github.com/sattyamjjain/agent-audit-kit/pull/567

Full Changelog: https://github.com/sattyamjjain/agent-audit-kit/compare/v0.3.72...v0.3.73

• This action is used across all versions by 15 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Xipher is a versatile cryptographic tool that provides key/password-based asymmetric encryption with optional post-quantum security. It simplifies the sharing of encrypted data between parties over insecure channels using password-derived public keys, offering a secure and efficient solution for both small and large data. The action automates tasks such as encryption, decryption, and streaming, making it easy to integrate into various workflows and applications.

What’s Changed

Changelog

• 8dd1cfbfb1b1c6d315415b528819907d85d3e04d bump deps
• 39ac53c63732b78822a59363a795fea562df20fa fix(xcp): give every block its own nonce instead of reusing one across a whole message
• 2042aa95a65c55fcf9aa3be2a184fc9a4d6fbb08 implicit trust for same-origin provider

• This action is used across all versions by 2 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Smyklot is a GitHub App that automates pull request approvals and merges by validating permissions against the repository’s CODEOWNERS file. It supports multiple command formats, allows for flexibility in merge methods, and provides emoji feedback to users. The action also handles reaction-based commands and ensures approval deduplication.

What’s Changed

1.22.1 (2026-08-11)

Smyklot v1.22.1

Docker image: ghcr.io/smykla-skalski/smyklot:1.22.1

Changelog

• 498d95c1fbad747aa1b4e324d0508e2e73c9bf3d chore(release): bump version to 1.22.1
• e0963ed025cbbac7f6c9fc12a4b2167a53588aad fix(panel): unhijack table scrolling and unclip tooltips (#188)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Ward is a pre-agent metadata scanner designed to detect and prevent prompt injection attacks. It screens AI agent inputs before they reach security tools like SAST or IaC scanners, catching attempts to inject malicious prompts into branch names, commit messages, PR titles, and file names. Ward uses benchmarks to measure its effectiveness in catching prompt injection attempts across different corpora.

What’s Changed

What’s Changed

• Release 0.3.2: pin the build, which broke the 0.3.1 upload by @Sonofg0tham in https://github.com/Sonofg0tham/ward/pull/18

Full Changelog: https://github.com/Sonofg0tham/ward/compare/v0.3.1...v0.3.2

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action replaces placeholders with environment variable values in a specified configuration file. It automates the process of updating environment-specific settings without manual intervention, ensuring consistency across different environments.

What’s Changed

• feat: Initial version (e440a96)

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

SSG is a static site generator written in Go that converts Markdown files with YAML frontmatter into a complete website, including features like templates, feeds, and SEO metadata. It automates the process of building websites quickly and efficiently, especially suitable for blogs, documentation, and company sites. The action simplifies the setup and maintenance of web projects by providing a fast, deterministic build system that handles content rendering and deployment.

What’s Changed

Installation

Quick Install (Linux/macOS)

curl -sSL https://raw.githubusercontent.com/spagu/ssg/main/install.sh | bash

Package Managers

• Homebrew: brew install spagu/tap/ssg
• Snap: snap install ssg
• Debian/Ubuntu: Download .deb file below
• Fedora/RHEL: Download .rpm file below

Checksums

See checksums.sha256 for file verification.

📖 Full documentation: https://github.com/spagu/ssg#readme

What’s Changed

• 1.8.26 — fixes for #114–#118 (WordPress migration + theme-authoring) by @spagu in https://github.com/spagu/ssg/pull/119

Full Changelog: https://github.com/spagu/ssg/compare/v1.8.25...v1.8.26

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action generates AI-written Markdown end-user change logs from Conventional Commits. It updates the CHANGELOG.md file in the working tree without committing or pushing changes. The action supports S3 and LinkedIn publishing options and has a user-facing types whitelist initially including feat, fix, perf, security, deprecate, and remove.

What’s Changed

What’s Changed

• chore: bump @vercel/ncc from 0.38.4 to 0.44.1 in the development group by @dependabot[bot] in https://github.com/sparepartslabs/spareparts-changelog/pull/7
• feat: add AI-generated public changelogs by @ike4est in https://github.com/sparepartslabs/spareparts-changelog/pull/8

New Contributors

• @dependabot[bot] made their first contribution in https://github.com/sparepartslabs/spareparts-changelog/pull/7

Full Changelog: https://github.com/sparepartslabs/spareparts-changelog/compare/v0.1.0...v0.2.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

LGTM is a GitHub Action that automates code review tasks by asking reviewers questions about changes in pull requests. It solves the problem of ensuring that reviewers have thoroughly read and understood the changes before approving them, promoting more thorough reviews and reducing misunderstandings. The action uses Claude, Codex, Cursor, GitHub Copilot, Gemini, or OpenCode as agents to generate questions based on the diff and reports the result as a check run. It ensures that code review decisions are informed by actual reading of the changes rather than just approvals.

What’s Changed

v1.3.1

Fixed

• Changelog entries are now published under the canonical changelog prefix.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

spek is a lightweight, read-only viewer for OpenSpec content. It automates the process of browsing, searching, and tracking BDD tasks within a local directory structure, providing a structured interface with features like BDD syntax highlighting, task progress tracking, and full-text search.

What’s Changed

Highlight: the rule beside an open section now starts and ends where its content does. 1.13.0 gave each requirement its own rule and a gap between them, but the rule was drawn down the section’s box — and a box holds two spaces its content does not. Reported from the IntelliJ tool window (issue #42), one round after the change that introduced the gap.

• The rule starts at its heading, not 20px above it. That space is also what separates a section from the one before it, so of the 28px between two requirements, 20px was drawn as rule — 1.13.0’s gap was real but invisible, and a page of requirements still read as one interrupted line with a notch in it
• And it ends at the last of its content, instead of running past it. The trailing space below a section’s last paragraph sits inside the box too, so the rule overshot the thing it was marking by a further 20px — plainest under the last scenario of a requirement
• An open requirement’s heading no longer sits 1px right of a closed one’s. The rule used to be a border, which inset everything inside an open section; drawn as its own element it does not. Headings and disclosure arrows now line up down the page regardless of open state
• The rule stays visible in Windows high contrast, where the previous drawing method would have been discarded
• A scenario written with no requirement above it now takes a top-level section’s spacing, 4px lower than before: how much room a section leaves above its heading follows its nesting, not its heading level

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Runward automates the verification of engineering decisions behind AI-generated code, ensuring that critical aspects of software delivery are adhered to. It provides a deterministic gate to check that the process was followed, making it easier to verify compliance with standards like ISO 42001 and NIST AI RMF.

What’s Changed

No verdict changes. The canary for ADR-0049: the first release whose provenance is signed by the isolated builder.

The tarball is built, tested and its provenance signed inside build-and-attest.yml, a reusable workflow whose steps release.yml cannot reach into; the signing certificate names that file. The publish job packs the same commit itself and refuses to publish a builder tarball that does not byte-match. npm publish stays under OIDC trusted publishing, unchanged.

What this release must establish, written before the tag:

gh attestation verify runward-0.33.5.tgz --repo stranxik/runward \
  --signer-workflow stranxik/runward/.github/workflows/build-and-attest.yml

passing on the published artifact; the determinism cross-check holding; a local rebuild of the attested commit reconciling byte for byte. verify-release.yml requires the signer identity on this run — the outcome is loud in both directions.

No SLSA level is asserted anywhere. Verification procedure: docs/verifying-a-release.md.

Full changelog: https://github.com/stranxik/runward/blob/main/CHANGELOG.md

• This action is used across all versions by 5 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The SFDX Deploy GitHub Action automates the deployment of Salesforce metadata to a target org, supporting source directories, manifest files, and metadata component selectors. It includes options for test levels, dry runs, and delta deployments, making it suitable for pull request validation and actual deployments to higher environments. The action also provides functionality to delete metadata deletions as post-destructive changes in delta mode.

What’s Changed

• pin action examples to exact releases and harden them

Full Changelog: https://github.com/svierk/sfdx-deploy/compare/v1.2.1...v1.2.2

• This action is used across all versions by 0 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the integration of Atlassian Jira Cloud with various tasks, such as retrieving issues, creating and updating them, managing comments and attachments, and triggering workflow transitions. It uses a Rust SDK to interact with the Jira REST API v2, providing a reusable solution for developers looking to build integrations or operators for Jira Cloud operations.

What’s Changed

Release v0.5.1

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates testing for Bash scripts using the bashunit framework, providing a simple and fast way to test bash functions, assertions, spies, mocks, data providers, snapshots, and more. It supports multiple features such as equality checks, string comparisons, exit codes, numeric assertions, array operations, file permissions, JSON parsing, date comparisons, duration measurements, snapshot matching, and test double verification.

What’s Changed

✨ Improvements

• --changed [<ref>] runs only the test files git reports as touched since <ref> (default origin/HEAD, then HEAD), covering committed, staged, unstaged and untracked changes (#1010)
• --order-by <defined|defects|random> picks the execution order; defects runs the last run’s failures first and still runs the whole suite (#1011)
• --list (alias --dry-run) prints the tests a run would execute without running them; --list-format json emits file, function, name, line and tags, honouring every selection flag including --shard (#1007)
• --exclude-filter <name> skips tests by name, the counterpart of --exclude-tag: repeatable, OR’d, and wins over --filter (#1009)
• --tag accepts expressions: 'a&&b' (AND), '!a' (NOT) and 'a&&!b'; repeated --tag flags keep OR semantics and --exclude-tag still wins (#1008)
• # @tags a b above any top-level line tags every test in the file, unioned with per-function # @tag (#1008)
• --repeat <n> runs each selected test n times to hunt flakiness before CI does: one report line with the aggregate outcome, a failure names its iteration, and repeat wraps --retry (#1013)
• Flaky is a first-class outcome: a test that only passed after a retry is counted separately, stays inside the pass total so the exit code is unchanged, and is carried into JUnit (<flakyFailure>), TAP, JSON, HTML and GitHub Actions with the first attempt’s failure message; --fail-on-flaky turns such a run red (#1012)
• --coverage-report-cobertura [file] writes Cobertura XML (default coverage/cobertura.xml), the format GitLab merge-request visualisation, Azure DevOps and Jenkins consume, with repo-relative filenames, per-line hits and condition-coverage on branch lines, alongside the LCOV and HTML reports (#1017)
• --coverage-diff <ref> limits the coverage console report to lines changed since a base ref; --coverage-min then gates on that diff percentage (#1032)
• --report-md <file> writes a Markdown run summary — verdict, counts table, failures with their message, plus coverage and slowest tests when those ran — and inside GitHub Actions appends it to $GITHUB_STEP_SUMMARY (#1015)
• GitHub Actions annotations print to stdout automatically inside Actions, carrying the failing test’s file and line so they land on the right line of the diff; --gha-annotations <auto|always|never> overrides the detection and action.yml gains an annotations input (#1014)
• assert_between <min> <max> <actual> and assert_not_between add inclusive numeric-range assertions for integers and decimals (#1026)
• assert_command_available <command> asserts a command, shell builtin or function resolves through command -v (#1027)
• --verbose reports the coverage engine in use, and an explicit BASHUNIT_COVERAGE_ENGINE=xtrace the running Bash cannot honour now warns instead of being silently ignored (#1005)

🛠️ Changes

• JUnit XML: one <testsuite> per test file with its own counts, time and timestamp instead of a single flat suite, classname on every <testcase>, <failure message="..."> carrying the first informative line of the real message with type="AssertionFailed", <system-out> with the test’s captured output, and aggregate totals on <testsuites>, so consumers that group by suite or classname (Jenkins, GitLab, dorny/test-reporter) get real groupings (#1016)
• Performance: --coverage is about 1.6x to 2.3x faster; executable-line classification no longer forks grep per source line, roughly half of a coverage run’s wall time on both engines (#1005)
• bashunit test --help lists --show-skipped and --show-incomplete, both accepted by the parser but never advertised; BASHUNIT_COVERAGE_SHOW_FUNCTIONS and BASHUNIT_COVERAGE_SHOW_UNCOVERED are registered in src/config/env.sh like every other setting, and .env.example now lists all 66 settings, 19 of which were missing (#1063)
• Docs: full audit of the reference pages against the code — docs/configuration.md gained the 17 settings it never documented, docs/command-line.md gained the assert subcommand section and real example output, and the coverage settings and diff-coverage narrative now live in one place instead of two that had drifted (#1063)

🐛 Bug Fixes

• Report formats are no longer empty under --parallel; --report-junit, --report-tap, --report-json, --report-html and --log-junit all recorded zero tests, because the rows were collected inside the per-test worker and nothing rebuilt them in the parent (#1004)
• A failed assertion is no longer reported twice: bashunit::assert_that returns 1 on failure by design, so a custom assertion ending with it made the test body exit non-zero and the runner printed a spurious ✗ Error on top of the ✗ Failed. Custom assertions no longer need a trailing return 0, and a real runtime error is still reported as an error (#1063)
• --coverage-report with no value uses coverage/lcov.info instead of aborting the run with $2: unbound variable, and no longer consumes a following flag as its filename; write the test path before it, since an optional value cannot be told apart from a path (#1063)
• --list --list-format json reports each tag as its own array element; the emitter split the tag list on whitespace while every other consumer splits it on commas, so two tags rendered as ["slow,fileTag"] (#1063)
• assert_within_delta rejects malformed numbers such as 1.2.3 or 5-3 as non-numeric instead of leaking a raw bc parse error or evaluating them as an expression (#1026)
• Build: the standalone binary size budget is 544 KiB, raised from 500 KiB after ordinary feature growth crossed it; the artifact keeps its indentation rather than being minified (#1045)

👥 Contributors

• @Chemaclass
• @fzlzjerry
• @w3lld1

Checksum

SHA256: c49fd3874c7df68170f6a22d76599031113f2bb8a5a3bca664fa056dc214e85f

Full Changelog: 0.45.0…0.46.0

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The Vigilnz Security Scan Action automates security scanning for applications and repositories using Vigilnz’s API. It supports multiple scan types including SCA, SBOM, SAST, IAC SCAN, SECRET SCAN, DAST, and CONTAINER SCAN. The action integrates seamlessly with GitHub workflows to help developers detect vulnerabilities during CI/CD pipelines securely and efficiently.

What’s Changed

Implement CI provenance metadata collection for scan requests Add branch resolution to scan requests for improved result grouping

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

RustScript is an action that enables Rust developers to run scripts without compiling them into binaries. It provides a practical subset of the language, allowing for quick execution and validation of code snippets, with support for concurrency using Tokio. The action supports compiling scripts to native binaries for performance-critical tasks. It also caches results of compiled checks and builds for efficient reusability.

What’s Changed

Full Changelog: https://github.com/VladasZ/rustscript/compare/v0.3.4...v0.3.5

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Prism Reviewer is an AI-driven multi-agent code review system that automates static analysis, dependency scanning, AST-based symbol inspection, and parallel LLM-guided code evaluation. It acts as a gatekeeper for pull requests by performing targeted reviews, providing detailed reports categorized by severity.

What’s Changed

Release v1.0.0

Publish to pypi

Changelog: https://github.com/vyoman-labs/prism-reviewer/blob/main/CHANGELOG.md#100---2026-08-11

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The action, wcagc CI, automates accessibility checks for GitHub and GitLab repositories using the WCAGc service. It compares current checks against a saved baseline and reports findings in PR comments or SARIF files, helping to ensure compliance with web standards while preserving manual review requirements. The action is designed to help developers catch accessibility issues early in the development process.

What’s Changed

What’s Changed

• fix(ci): automate immutable action releases by @pcherkasov in https://github.com/WCAG-Compliance/wcagc-ci/pull/1

New Contributors

• @pcherkasov made their first contribution in https://github.com/WCAG-Compliance/wcagc-ci/pull/1

Full Changelog: https://github.com/WCAG-Compliance/wcagc-ci/compare/v1.1.0...v1.2.0

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action generates a customizable open-source contribution banner (SVG + PNG) for your GitHub profile README, measuring contributions across other repositories. It automates the process of tracking and displaying metrics like merged pull requests, reviews given, and projects contributed to, making it easy to showcase your involvement in the community without relying solely on repository stars.

What’s Changed

What’s Changed

Other changes

• feat: add ignore-languages input to filter generated/vendored files by @yashksaini-coder in https://github.com/yashksaini-coder/GitBanner/pull/2
• Redesign: measure external contributions instead of own-repo stats by @yashksaini-coder in https://github.com/yashksaini-coder/GitBanner/pull/3

Full Changelog: https://github.com/yashksaini-coder/GitBanner/compare/v1.1.0...v1.2.0

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 16.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

B.IA is a GitHub Action that integrates accessibility checks into CI/CD pipelines. It allows companies to define an audience and a percentage of guidelines to be met, using AI to analyze and measure guidelines. The action helps ensure products comply with WCAG guidelines by providing feedback on any violations, allowing developers to correct solutions efficiently.

What’s Changed

• feat: add parse debug (229d26d)
• feat: json response schema (3d2a1fe)
• feat: update build (1646112)
• feat: update code (41bf74f)
• feat: update dist (5ffd432)
• feat: add githubToken in action (b20caef)
• feat: add logs for debug (a29f11d)
• fix: order (75ba53e)
• feat: add runController (7338606)
• feat: add service (34c25e0)

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action allows users to execute templates as shell commands in a safe and repeatable manner, with options to throw on failure or capture output. It ensures injection safety by not using any third-party dependencies and focuses only on basic tasks needed for template execution.

What’s Changed

1.38.1 (2026-08-11)

Bug Fixes

• core: close three trust gaps at the backend, registry and cache boundaries (#330) (37fbf34)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Acquit analyzes a repository’s dependency graph and selectively skips tests that are not affected by changes in the pull request. It uses static analysis to determine which tests can be skipped, ensuring only potentially unsafe changes are included in the test suite. The action is designed to improve build times and reduce unnecessary testing in large codebases.

What’s Changed

0.1.1 (2026-08-09)

Bug Fixes

• resolve the release-please merge conflict, keep v5 and the dispatch step (27a33ce)
• unique Marketplace display name, the bare word collides (72d6b16)

Documentation

• pin the quickstart to v0.1.0 (f3da1f0)

• This action is used across all versions by 2 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Outrider is a GitHub Action designed to turn briefs into review-ready PRs by automating the process of implementing and testing code. It uses Anthropic Opus and z.ai GLM-5.2 as backend models to suggest and evaluate candidate implementations based on their relevance to a user’s research interest or other triggers like search queries or pinning specific papers. The action generates draft PRs with complete implementation details, including test cases, license information, and references cited, ensuring that the maintainer has all necessary evidence for reviewing the changes.

What’s Changed

Two layered mitigations against indirect prompt injection through external content Outrider ingests (Discussions, merged-PR bodies, lead-content URLs).

Content-source labeling — wrap external content in <untrusted_content source="…"> tags with a preamble instructing the model NOT to treat instructions inside as directives. Applies to the Discussions block (v1.7.49), merged-PR block, and lead-content override sites.

Canary-gated routing — per-run token in INVOCATION.md that the coding agent must write to .remyx-recommendation/SPEC_ACK.txt before finishing. Missing token downgrades PR mode to Issue and flags branch mode as branch_pushed_canary_missing. Bundle dir is scrubbed before staging, so the canary never lands in the merged diff.

Validated against two attack shapes on a controlled fork:

• Payload hidden in a collapsed <details> block → blocked
• Payload buried mid-page in verbose corporate policy text → blocked

27 new tests; full suite 1230 passed. See #117.

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action prints a greeting message to the log, either “Hello World” or “Hello [name]”, and optionally provides the current time. It automates the task of sending personalized greetings in automated workflows. The action accepts an optional input for the person’s name and outputs the current timestamp.

What’s Changed

Full Changelog: https://github.com/RivieraKid/gha-kaniko/compare/v1...v0.0.1

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

cryload is a modern, cross-platform HTTP load testing CLI that automates performance testing in CI/CD pipelines. It provides features like concurrent connections, latency percentiles, CI thresholds, JSON/CSV output, and supports multi-URLs, custom success codes, and rate limiting. The action allows for easy integration into GitHub Actions to validate deployment performance.

What’s Changed

• GitHub Action — Shortened the action.yml description to 117 characters; GitHub Marketplace rejects listings whose description is 125 characters or longer, which blocked publishing v5.2.0

• This action is used across all versions by 1 repositories.

Action Type

This is a Node action using Node version 16.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action uses Amazon Bedrock Agent to analyze code files in a PR and provide feedback. It integrates with Knowledge Bases for enhanced context-aware insights and supports customizable prompts, memory, and language-agnostic analysis. The action is tailored for various use cases, including code quality improvement and performance optimizations. It seamlessly integrates with the AWS ecosystem and provides detailed, markdown-formatted comments as feedback in the PR.

What’s Changed

What’s Changed

• Support push events by @severity1 in https://github.com/severity1/custom-amazon-bedrock-agent-action/pull/29
• Support push events by @severity1 in https://github.com/severity1/custom-amazon-bedrock-agent-action/pull/30
• Support push events by @severity1 in https://github.com/severity1/custom-amazon-bedrock-agent-action/pull/31

Full Changelog: https://github.com/severity1/custom-amazon-bedrock-agent-action/compare/v0.9.0...v0.10.0

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Sherpa.sh is an AI-powered tool that automates the deployment of applications to various cloud providers. It simplifies infrastructure management by allowing users to describe their needs in plain English, and Sherpa generates and configures the necessary resources, including servers, DNS, SSL certificates, CDN, databases, backups, load balancing, and more. This makes it easier for developers to focus on writing code rather than managing complex configurations.

What’s Changed

AI-powered deployments in plain English

Sherpa transforms any cloud provider into a deployment platform. Just describe what you want and let the AI handle the infrastructure.

prompt: “Deploy my Next.js app on AWS Lambda with CloudFront CDN”

Highlights

• Plain English Infrastructure - No YAML configs, no Terraform, no DevOps expertise required
• Multi-Cloud - AWS and Cloudflare supported, with more providers coming
• GitHub Actions Integration - Push-to-deploy workflows with memory persistence
• Claude Code CLI Support - Test locally before committing

Supported Features

Quick Start

- uses: sherpa-sh/sherpa-action@v1.0.0-alpha
  with:
    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
    prompt: "Deploy my app to Cloudflare"
  env:
    CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

Alpha Notice

This is an early release. Expect breaking changes and rough edges. We'd love your feedback—please https://github.com/sherpa-sh/sherpa-action/issues or https://discord.com/invite/Pn7N2Wwbjy.

• This action is used across all versions by 6 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action installs the latest Constellation CLI and indexes your repository’s codebase using Tree-sitter AST analysis, ensuring AI assistants can understand your code without transmitting source code. It provides a privacy-first approach by extracting only AST metadata and offers automatic updates to the CLI version. The action supports cross-platform operation on Ubuntu, macOS, and Windows runners and includes a smart diff detection mechanism to skip indexing when no files matching the configuration have changed.

What’s Changed

What’s new?

• Incremental indexing in CI: every trigger now ensures full git history is available (self-healing shallow clones), so the CLI can compute deltas against the last indexed commit instead of falling back to a full re-index on each push — dramatically reducing index churn
• No more waiting on the server: the action now finishes as soon as the upload is accepted instead of polling until server-side indexing completes, cutting idle runner minutes; a new wait input (default "false") restores the old behavior for workflows that need the completed index
• Manual runs are truly full re-indexes: workflow_dispatch triggers now explicitly request a full re-index, guaranteeing a clean rebuild when you click “Run workflow”
• More reliable diff-checks on shallow clones — pushes that touch no tracked files can now skip indexing entirely

Full Changelog: https://github.com/ShiftinBits/constellation-github/compare/v1.2.2...v1.2.3

• This action is used across all versions by 2 repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Smyklot is a GitHub App that automates pull request approvals and merges by validating permissions against the repository’s CODEOWNERS file. It supports multiple command formats, including slash commands, mentions, and bare commands, and provides options to approve, merge, squash, rebase, remove approvals, and clean up comments. The app also handles reaction-based commands for approval and merging and maintains a history of reactions removed from approvals/merges.

What’s Changed

1.21.2 (2026-08-11)

Smyklot v1.21.2

Docker image: ghcr.io/smykla-skalski/smyklot:1.21.2

Changelog

• 41e3daf552efc8e7b614e8cca74ed9b78ba2cf6d chore(release): bump version to 1.21.2
• 4166b2e89acf0ac412564b3d8ba41548467753fe fix(panel): compact workspace picker (#186)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action reads configuration files and replaces placeholders with values from environment variables, making it easier to manage sensitive data securely during deployment.

What’s Changed

• feat: Add support for .env files (e706be3)
• chore: More info (d440258)
• feat: Initial version (e440a96)

• This action is used across all versions by ? repositories.

Action Type

This is a Node action using Node version 20.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the deployment of a Docker Swarm service by bundling and committing the dist folder before pushing it to the repository. It ensures that the latest production-ready version is deployed without manual intervention, streamlining the process of deploying changes to the swarm environment.

What’s Changed

• fix: Update dependencies (5336574)
• fix: Update dependencies (e9c2fe7)
• fix: Update dependencies (0b48905)
• fix: Update dependencies (7cff14c)
• fix: Improve error output (7cd1d73)
• fix: Improve error output (92f3eca)
• fix: Improve error output (4db44f1)
• fix: Update dependencies (0ff3213)
• Create README.md (e1316ba)
• fix: Run bundle in Linux container to ensure dist is the same locally and on github (eb002ab)

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the process of asking reviewers questions about pull requests they approve, generating the questions from the diff. It solves the problem of ensuring that everyone reads the pull request before approving it and provides a user-friendly experience by offering unlimited attempts without scoring or marking reviews as failed. The action uses an agent matrix supported by Claude, Codex, Cursor, GitHub Copilot, Gemini, and OpenCode to generate the questions.

What’s Changed

• Merge pull request #14 from sparepartslabs/feat/lgtm-agent-plugin (76cd8c4)
• docs: lead with agent-neutral LGTM workflow (4d635c1)
• feat: package LGTM agent plugin (661916c)
• chore(ec): install shared constitution workflow (52aaacd)
• chore(ec): install shared constitution workflow (3ce27c8)
• Rename action from ‘LGTM’ to ‘Spare Parts LGTM’ (e8629a1)
• Merge pull request #10 from sparepartslabs/dependabot/npm_and_yarn/dev-1939bc3e6a (b519b4e)
• chore: bump the dev group with 2 updates (47df768)
• feat: publish action (b089510)
• feat: secrets, tests, deps (2718cef)

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action integrates GitHub Classroom with Google Sheets to automatically send assignment results. It solves the problem of manually updating students’ grades and scores in Google Sheets by automating this process through API credentials, secrets, and workflows. The action supports multiple tasks and automatically updates or creates columns and rows in the Google sheet based on the task results.

What’s Changed

First working version with basic functionality

• This action is used across all versions by ? repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The rag-redteam GitHub Action is designed to test RAG pipelines for potential security vulnerabilities such as indirect prompt injection and source-document leakage. It automates these tests by simulating attacks on the pipeline and failing the build if any vulnerabilities are found, ensuring that sensitive information remains protected in the retrieved documents. The action can be used with local or remote RAG implementations, providing a comprehensive security check for LLM-based retrieval pipelines.

What’s Changed

pip install rag-redteam==0.6.0 — still zero runtime dependencies.

What changed

Every probe now samples a grammar. Six of the seven replayed between one and four hardcoded strings, which is too little to support a conclusion: cross-document decided a published 100% on a single attempt, and measures 17% at 300 trials. Grammars run from 480 to over 5,000 combinations. Use --trials.

Reference defenses (rag_redteam.defenses) wrap any target, and each declares whether it is structural — holding regardless of what the model decides — or advisory, working by persuading it. That distinction turned out to matter more than the defenses themselves.

A utility metric reported beside attack success, because a defense that refuses every query scores a perfect 0% on every probe and is also a broken product. This caught a real bug before release: the first real-model run read 0% across every security column while answering half the ordinary questions.

An HTTP adapter — point it at an endpoint instead of writing a Python target:

rag-redteam run --target-url https://my-rag.example.com/ask

Private and loopback addresses are refused by default, so the same code is safe in a hosted scanner.

What the runs found

8,400 injection attempts across four models and four retrieval stacks:

• Filter evasion anti-correlates with attack success, r = −0.79. base64 evades a pattern filter 57% of the time and breaks the pipeline 0% of the time. Plain uppercase is caught 91% of the time and is the strongest attack tested.
• That relationship moves with the model. base64 goes 0% → 0% → 18% → 2% across the capability ladder; rot13 stays at 0% until the newest model obeys it 9% of the time. A filter’s least important weakness becomes a live hole on upgrade day, with nothing about the filter having changed.
• Alignment narrows the funnel, capability widens the door. The hardest model to inject is the only one that obeys every encoding tested.
• Defenses cut injection 37% → 10% and cannot close it, and every point of that comes from an advisory defense. Structural defenses alone leave injection at exactly the undefended rate.

Full write-up in docs/FINDINGS.md. Live demo and browser scanner: https://srivatsa03.github.io/rag-redteam/

Limits

Everything here is non-adaptive, which is known to overestimate robustness, so read the numbers as a lower bound on exposure. All four models are OpenAI, so the ladder is a within-family result.

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the linting and formatting of Ruby code using the Standard Ruby tool. It runs bundle exec standardrb --fix on the repository’s root directory, committing any auto-fixable errors back to the repo. If any errors remain, it fails the build with annotations for each failure. The action can be added to a workflow or existing job in GitHub Actions, allowing developers to maintain code quality and consistency without manual intervention.

What’s Changed

What’s Changed

• Smoke test this action against example sinatra apps. by @jasonkarns in https://github.com/standardrb/standard-ruby-action/pull/32
• Pin action dependencies to full sha for security by @jasonkarns in https://github.com/standardrb/standard-ruby-action/pull/34
• Configure dependabot for bundler in example dirs by @jasonkarns in https://github.com/standardrb/standard-ruby-action/pull/35
• Bump actions/checkout from 4.2.1 to 4.2.2 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/36
• Bump ruby/setup-ruby from 1.244.0 to 1.245.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/37
• Enhance ruby-version selection by @jasonkarns in https://github.com/standardrb/standard-ruby-action/pull/39
• Rename workdir to working-directory by @jasonkarns in https://github.com/standardrb/standard-ruby-action/pull/40
• Bump ruby/setup-ruby from 1.245.0 to 1.247.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/42
• Bump step-security/harden-runner from 2.12.2 to 2.13.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/41
• Bump ruby/setup-ruby from 1.247.0 to 1.253.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/43
• Bump ruby/setup-ruby from 1.253.0 to 1.254.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/44
• Bump actions/checkout from 4.2.2 to 4.3.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/45
• Bump actions/checkout from 4.3.0 to 5.0.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/46
• Bump ruby/setup-ruby from 1.254.0 to 1.255.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/47
• Bump ruby/setup-ruby from 1.255.0 to 1.257.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/49
• Bump step-security/harden-runner from 2.13.0 to 2.13.1 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/50
• Bump ruby/setup-ruby from 1.257.0 to 1.262.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/51
• Bump ruby/setup-ruby from 1.262.0 to 1.265.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/53
• Bump ruby/setup-ruby from 1.265.0 to 1.266.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/54
• Bump ruby/setup-ruby from 1.266.0 to 1.267.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/55
• Bump step-security/harden-runner from 2.13.1 to 2.13.2 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/56
• Bump ruby/setup-ruby from 1.267.0 to 1.268.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/58
• Bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/57
• Bump step-security/harden-runner from 2.13.2 to 2.13.3 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/62
• Bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/61
• Bump ruby/setup-ruby from 1.268.0 to 1.269.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/60
• Bump ruby/setup-ruby from 1.269.0 to 1.270.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/64
• Bump step-security/harden-runner from 2.13.3 to 2.14.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/63
• Bump ruby/setup-ruby from 1.270.0 to 1.275.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/65
• Bump ruby/setup-ruby from 1.275.0 to 1.276.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/66
• Bump ruby/setup-ruby from 1.276.0 to 1.278.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/67
• Bump ruby/setup-ruby from 1.278.0 to 1.281.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/68
• Bump ruby/setup-ruby from 1.281.0 to 1.284.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/69
• Bump step-security/harden-runner from 2.14.0 to 2.14.1 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/72
• Bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/71
• Bump ruby/setup-ruby from 1.284.0 to 1.286.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/70
• Decrease dependabot frequence to monthly for GHA by @jasonkarns in https://github.com/standardrb/standard-ruby-action/pull/73
• Bump ruby/setup-ruby from 1.286.0 to 1.288.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/74
• Bump ruby/setup-ruby from 1.288.0 to 1.302.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/76
• Bump step-security/harden-runner from 2.14.1 to 2.18.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/75
• Don’t pin production dependencies to SHAs by @jasonkarns in https://github.com/standardrb/standard-ruby-action/pull/81
• Bump step-security/harden-runner from 2.18.0 to 2.19.3 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/78
• Bump step-security/harden-runner from 2.19.3 to 2.19.4 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/84
• Bump actions/checkout from 6.0.2 to 7.0.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/83
• Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/87
• Bump step-security/harden-runner from 2.19.4 to 2.20.0 by @dependabot[bot] in https://github.com/standardrb/standard-ruby-action/pull/86

New Contributors

• @dependabot[bot] made their first contribution in https://github.com/standardrb/standard-ruby-action/pull/36

Full Changelog: https://github.com/standardrb/standard-ruby-action/compare/v1.5.0...v1.6.0

• This action is used across all versions by 0 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

Runward automates AI-assisted software engineering by verifying that the engineering decisions behind AI-written code were followed deterministically. It provides a way to check whether the architecture, where things run, how it’s secured, and how it’s handed over were correctly handled after the code ships. The action scaffolds a filled reference mission and ends by running the strict gate itself, ensuring the load-bearing decisions were actually made and written down.

What’s Changed

No verdict changes. The release path now carries its own proof, two claims that were true became enforced, and the gate’s requirements are stated one at a time with the test that exercises each.

The release carried no proof

Until today a GitHub release carried the SBOM and nothing else — not the tarball, not a single attestation:

v0.33.2: runward-sbom.cdx.json
v0.33.1: runward-sbom.cdx.json
v0.33.0: runward-sbom.cdx.json

The provenance existed — npm audit signatures returns it, and deps.dev shows Google verifying it independently — but it lived on the npm registry, and a GitHub release is where most people look.

So OpenSSF Scorecard read the release assets and answered, verbatim:

Signed-Releases: 0 — Project has not signed or included provenance with any releases.

The project’s own public scorecard contradicted its strongest claim, across at least three releases.

The real bundle now goes up under the .intoto.jsonl name the ecosystem reads, with the tarball beside it: an attestation whose subject the reader cannot fetch from the same place proves nothing they can act on. test -s "$BUNDLE" reds the release rather than shipping a silent gap.

This release is the first proof that the path works. It could not be tested any other way.

Two lines the compliance sheet could only assert

npm audit --audit-level=high on every pull request. There was no such job — grep -rn "npm audit" .github/workflows/ returned nothing, and a HIGH advisory sat green and unmerged while a release was cut. Scoped to high and above on purpose: a floor at low reds on advisories nobody would act on, and a guard that cries on the safe case gets switched off.

A coverage floor. The coverage script existed and nothing called it. A ratchet, not a target: 78 against a measured 80.41, moved only by a deliberate commit. ADR-0046 refuses a threshold on the mutation score for reasons that do not transfer — a mutation score is a property of the tests, whereas line coverage is recomputed from scratch on every run.

Tool operational requirements

51 requirements over the verdict surface, each citing a test file and a case name inside it. The substance was already in runward/contracts/port-contract.md — in prose, with zero identifiers. Prose cannot be checked off: an assessor asks which requirement, verified where.

Each entry states what a green leaves open, per requirement. TOR-028 is the one to read first: a tampered seal reddens the gate, and the same entry says the seal establishes nothing about when it was written, because sealedAt is the mission’s word.

It is not a qualification kit, and says so in its own opening: a vendor kit’s documents are produced under a quality system a third party has assessed, and these are produced by one maintainer with no external assessment of any kind. Its traceability guard checks that a citation resolves, never that the cited test is relevant. Section 10 names what carries no requirement at all.

Why runward issues no attestation about your application

The answer is no, in any form, and the reason is measured rather than principled: the machine contract cannot distinguish a substantial mission from one carrying no project code, the corpus belongs to the audited party, the seal date is the mission’s word, and issuer, subject and verifier would be the same party.

What can be published instead is a replayable record, by the operator, in their own repository — with the admission that on a private repository the only level that checks content is unavailable to an outside reader, which is the commonest case.

Test suite

428 → 435, and 98 mutants that survived the entire net now die. Re-measured before instructing: the derived figure was 199, the measured one 179, because twenty had been killed by tests that never aimed at them. 81 survivors remain, filed as a register rather than a backlog.

Full changelog: https://github.com/stranxik/runward/blob/main/CHANGELOG.md

• This action is used across all versions by ? repositories.

Action Type

This is a Docker action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

The AgentScan Action automates the security scanning of AI agent skills before they are run in GitHub Actions workflows. It uses a deterministic local scanner to identify and report potential security issues such as shell commands, network calls, secrets, licenses, and obfuscation. The action helps prevent risky skills from being deployed by failing the build when it detects findings at or above a specified severity threshold, while still printing all findings in the log for review.

What’s Changed

AgentScan is a local scanner for AI agent skills. Point it at any Claude Code, Codex, or OpenCode skill directory before you install. It shows what the skill does: permissions, network calls, secrets, license. A scan takes seconds and returns file:line evidence for every finding, so the verdict is yours. It never runs the skill. It never sends data.

• This action is used across all versions by 0 repositories.

Action Type

This is a Node action using Node version 24.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action automates the semantic versioning and release pipeline using Tish, a modern JavaScript runtime. It supports both Node.js and Tish-native environments and provides dual runtimes. The action is configured via file, package.json, environment variables, or JSON/YAML configuration options. It handles conventional Commits and semver for bumping versions, with soft-skipping on non-release branches. It also supports recoveries with the --force/SEM_FORCE flag and auto-republishs when a git tag exists but the version is missing from npm. The action promotes GitHub releases through the promote-style pattern, including prerelease assets and unchecking pre-release status for publishing workflows.

What’s Changed

1.3.3 (2026-08-10)

Bug Fixes

• skip npm publish when the GitHub release is still a draft (023520d)

Published to npm: https://www.npmjs.com/package/@tishlang/sem/v/1.3.3 GitHub Packages: https://github.com/tishlang/sem/pkgs/npm/sem GitHub Action: uses: tishlang/sem@v1.3.3

• This action is used across all versions by 1 repositories.

Action Type

This is a Composite action.

Go to the GitHub Marketplace to find the latest changes.

Action Summary

This GitHub Action is a static-analysis linter for Docker Compose files that checks for security vulnerabilities such as privileged containers, unpinned images, host-network sharing, sensitive bind mounts, hard-coded credentials, and more. It catches these issues before they reach production and provides auto-fixes for unambiguous problems during a dry-run. The action leverages OWASP and CIS Docker Benchmarks to ensure compliance with best practices.

What’s Changed

Upgrading from 0.15.x

Your CI verdict may change in both directions, on files you have not touched. This release re-derived every severity and moved findings between rules, so a gate that passed may fail and a gate that failed may pass. Nothing here is a parser change: the same file is being read the same way and priced differently.

The hazard worth reading twice: a waiver can still parse and no longer cover anything. A retired rule id warns on load — config: unknown rule id 'CL-0012'; the override has no effect — and --strict-config turns that into an error. But a waiver naming a rule that still exists is silent, even when the finding it was written for has moved:

rules:
  CL-0011:
    reason: "we need SYS_ADMIN for the FUSE mount"   # no longer covers it

SYS_ADMIN is CL-0024 now. The config is valid, nothing warns, and the finding comes back at CRITICAL. Check every waiver against the table below.

Where findings moved

Generated by linting one trigger per row under both versions.

Newly flagged — a passing file can now fail

No longer flagged — a failing file can now pass

cap_add: DAC_OVERRIDE · userns_mode: host · devices: /dev/fuse · /dev/null, /dev/zero, /dev/full, /dev/random, /dev/urandom · a project directory under a home dir (/home/alice/proj/data) · /var/lib/mysql, /var/lib/postgresql/data and other service state dirs · anything that was CL-0012, CL-0015 or CL-0023.

Check your own files rather than reasoning about this list

compose-lint check --format json . > before.json   # on 0.15.x
pip install --upgrade compose-lint
compose-lint check --strict-config .               # dead rule ids become errors
compose-lint check --format json . > after.json
diff <(jq -S '[.findings[]|{rule_id,line,service}]' before.json) \
     <(jq -S '[.findings[]|{rule_id,line,service}]' after.json)

The diff catches the moved-waiver case, which no warning can reach.