yaml
name: Check for outdated GitHub Actions
on:
  pull_request:
    types: [edited, opened, synchronize, reopened]
jobs:   check-actions:     name: Check for GHA updates     runs-on: ubuntu-latest     permissions:       contents: read       pull-requests: write       issues: write     steps:       - name: Checkout repository         uses: actions/checkout@v4
- name: Setup Node.js         uses: actions/setup-node@v4         with:           node-version: '20'
- name: Install actions-up         run: npm install -g actions-up
- name: Run actions-up check         id: actions-check         env:           GITHUBTOKEN: ${{ secrets.GITHUBTOKEN }}         run: |           set -euo pipefail           echo "## GitHub Actions Update Check" >> $GITHUBSTEPSUMMARY           echo "" >> $GITHUBSTEPSUMMARY
# Run actions-up and capture machine-readable output           echo "Running actions-up to check for updates..."           actions-up --json > actions-up-report.json
UPDATE_COUNT=$(node -pe "JSON.parse(require('node:fs').readFileSync('actions-up-report.json', 'utf8')).summary.totalUpdates")
# Create formatted output           if [ &quot;$UPDATE_COUNT&quot; -gt 0 ]; then             echo &quot;Found $UPDATECOUNT GitHub Actions with available updates&quot; &gt;&gt; $GITHUBSTEP_SUMMARY             echo &quot;&quot; &gt;&gt; $GITHUBSTEPSUMMARY             echo &quot;&lt;details&gt;&quot; &gt;&gt; $GITHUBSTEPSUMMARY             echo &quot;&lt;summary&gt;Click to see JSON report&lt;/summary&gt;&quot; &gt;&gt; $GITHUBSTEPSUMMARY             echo &quot;&quot; &gt;&gt; $GITHUBSTEPSUMMARY             echo &#39;</code></pre>json' >> $GITHUBSTEPSUMMARY             cat actions-up-report.json >> $GITHUBSTEPSUMMARY             echo '<pre><code class="lang-">&#39; &gt;&gt; $GITHUBSTEPSUMMARY             echo &quot;&lt;/details&gt;&quot; &gt;&gt; $GITHUBSTEPSUMMARY
# Create detailed markdown report with better formatting             node --input-type=module &lt;&lt;&#39;EOF&#39;             import { readFileSync, writeFileSync } from &#39;node:fs&#39;
let report = JSON.parse(readFileSync(&#39;actions-up-report.json&#39;, &#39;utf8&#39;))             let lines = [               &#39;## GitHub Actions Update Report&#39;,               &#39;&#39;,               &#39;### Summary&#39;,               - Updates available: ${report.summary.totalUpdates},               &#39;&#39;,               &#39;### Updates&#39;,               &#39;&#39;,             ]

for (let update of report.updates) {               let file = update.action.file ?? &#39;unknown&#39;               let currentVersion = update.currentVersion ?? &#39;unknown&#39;               let latestVersion = update.latestVersion ?? &#39;unknown&#39;               lines.push(                 - \${update.action.name}\ in \${file}\: \${currentVersion}\ → \${latestVersion}\,               )             }

lines.push(&#39;&#39;)             lines.push(&#39;Run npx actions-up locally to review and apply updates.&#39;)

writeFileSync(&#39;actions-up-report.md&#39;, lines.join(&#39;\n&#39;))           EOF
echo &quot;has-updates=true&quot; &gt;&gt; $GITHUB_OUTPUT             echo &quot;update-count=$UPDATECOUNT&quot; &gt;&gt; $GITHUBOUTPUT           else             echo &quot;All GitHub Actions are up to date!&quot; &gt;&gt; $GITHUBSTEPSUMMARY
{               echo &quot;## GitHub Actions Update Report&quot;               echo &quot;&quot;               echo &quot;### All GitHub Actions in this repository are up to date!&quot;               echo &quot;&quot;               echo &quot;No action required. Your workflows are using the latest versions of all GitHub Actions.&quot;             } &gt; actions-up-report.md
echo &quot;has-updates=false&quot; &gt;&gt; $GITHUB_OUTPUT             echo &quot;update-count=0&quot; &gt;&gt; $GITHUB_OUTPUT           fi
- name: Comment PR with updates         if:           github.eventname == &#39;pullrequest&#39; &amp;&amp;           github.event.pullrequest.head.repo.fullname == github.repository         uses: actions/github-script@v7         with:           script: |             const fs = require(&#39;fs&#39;);             const report = fs.readFileSync(&#39;actions-up-report.md&#39;, &#39;utf8&#39;);             const hasUpdates = &#39;${{ steps.actions-check.outputs.has-updates }}&#39; === &#39;true&#39;;
// Check if we already commented             const comments = await github.paginate(github.rest.issues.listComments, {               owner: context.repo.owner,               repo: context.repo.repo,               issue_number: context.issue.number             });
const botComment = comments.find(comment =&gt;               comment.user.type === &#39;Bot&#39; &amp;&amp;               comment.body.includes(&#39;GitHub Actions Update Report&#39;)             );
const commentBody = ${report}
---             Generated by actions-up | Last check: ${new Date().toISOString()};

// Only comment if there are updates or if we previously commented             if (hasUpdates || botComment) {               if (botComment) {                 // Update existing comment                 await github.rest.issues.updateComment({                   owner: context.repo.owner,                   repo: context.repo.repo,                   comment_id: botComment.id,                   body: commentBody                 });                 console.log(&#39;Updated existing comment&#39;);               } else {                 // Create new comment only if there are updates                 await github.rest.issues.createComment({                   owner: context.repo.owner,                   repo: context.repo.repo,                   issue_number: context.issue.number,                   body: commentBody                 });                 console.log(&#39;Created new comment&#39;);               }             } else {               console.log(&#39;No updates found and no previous comment exists - skipping comment&#39;);             }
// Add or update PR labels based on status             const labels = await github.rest.issues.listLabelsOnIssue({               owner: context.repo.owner,               repo: context.repo.repo,               issue_number: context.issue.number             });
const hasOutdatedLabel = labels.data.some(label =&gt; label.name === &#39;outdated-actions&#39;);
if (hasUpdates &amp;&amp; !hasOutdatedLabel) {               // Add label if updates are found               try {                 await github.rest.issues.addLabels({                   owner: context.repo.owner,                   repo: context.repo.repo,                   issue_number: context.issue.number,                   labels: [&#39;outdated-actions&#39;]                 });                 console.log(&#39;Added outdated-actions label&#39;);               } catch (error) {                 console.log(&#39;Could not add label (might not exist in repo):&#39;, error.message);               }             } else if (!hasUpdates &amp;&amp; hasOutdatedLabel) {               // Remove label if no updates               try {                 await github.rest.issues.removeLabel({                   owner: context.repo.owner,                   repo: context.repo.repo,                   issue_number: context.issue.number,                   name: &#39;outdated-actions&#39;                 });                 console.log(&#39;Removed outdated-actions label&#39;);               } catch (error) {                 console.log(&#39;Could not remove label:&#39;, error.message);               }             }
- name: Fail if outdated actions found         if: steps.actions-check.outputs.has-updates == &#39;true&#39;         run: |           echo &quot;::error:: Found ${{ steps.actions-check.outputs.update-count }} outdated GitHub Actions. Please update them before merging.&quot;           echo &quot;&quot;           echo &quot;You can update them by running: npx actions-up&quot;           echo &quot;Or manually update the versions in your workflows.&quot;           exit 1</code></pre>