@pnpm/deps.github-actions 1100.1.0 → 1100.1.1

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @pnpm/deps.github-actions
 
+## 1100.1.1
+
+### Patch Changes
+
+- Checking GitHub Actions dependencies for updates is now opt-in for every command. Neither `pnpm outdated` nor `pnpm update` reads the workflow files unless `--include-github-actions` is passed or `update.githubActions` is set to `true` in `pnpm-workspace.yaml`. Reading them runs `git ls-remote` against every referenced repository, which fails in environments where GitHub is not reachable the way pnpm assumes (a GitHub Enterprise Server, a custom certificate authority, or an offline network) [#13254](https://github.com/pnpm/pnpm/issues/13254).
+
+  `pnpm outdated` accepts the `--include-github-actions` option too.
+
+- Updated dependencies:
+  - @pnpm/resolving.git-resolver@1100.1.13
+
 ## 1100.1.0
 
 ### Minor Changes

package/lib/index.d.ts

@@ -22,6 +22,19 @@ export interface FindOutdatedGitHubActionsOptions extends GitHubActionsOptions {
 export interface UpdateGitHubActionsOptions extends GitHubActionsOptions {
     latest?: boolean;
 }
+export interface GitHubActionsOptInOptions {
+    includeGithubActions?: boolean;
+    updateConfig?: {
+        githubActions?: boolean;
+    };
+}
+/**
+ * GitHub Actions dependencies are opt-in. Reading them means running
+ * `git ls-remote` against every referenced repository, so `pnpm outdated` and
+ * `pnpm update` only look at workflow files when asked to, either with
+ * `--include-github-actions` or with `update.githubActions: true`.
+ */
+export declare function shouldCheckGitHubActions(opts: GitHubActionsOptInOptions): boolean;
 export declare function isGitHubActionSelector(selector: string): boolean;
 export declare function normalizeGitHubActionSelector(selector: string): string;
 export declare function findOutdatedGitHubActions(opts: FindOutdatedGitHubActionsOptions): Promise<OutdatedGitHubAction[]>;

package/lib/index.js

@@ -11,6 +11,15 @@ import writeFileAtomic from 'write-file-atomic';
 import YAML, { isMap, isNode, isScalar, isSeq } from 'yaml';
 const SHA_PATTERN = /^[0-9a-f]{40}$/;
 const limitRepoReads = pLimit(8);
+/**
+ * GitHub Actions dependencies are opt-in. Reading them means running
+ * `git ls-remote` against every referenced repository, so `pnpm outdated` and
+ * `pnpm update` only look at workflow files when asked to, either with
+ * `--include-github-actions` or with `update.githubActions: true`.
+ */
+export function shouldCheckGitHubActions(opts) {
+    return opts.includeGithubActions === true || opts.updateConfig?.githubActions === true;
+}
 export function isGitHubActionSelector(selector) {
     const pattern = selector.startsWith('!') ? selector.slice(1) : selector;
     return !pattern.startsWith('@') && pattern.includes('/');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.github-actions",
-  "version": "1100.1.0",
+  "version": "1100.1.1",
   "description": "Discover and update GitHub Actions dependencies",
   "keywords": [
     "pnpm",
@@ -29,10 +29,10 @@
   ],
   "dependencies": {
     "@pnpm/error": "1100.1.0",
-    "@pnpm/resolving.git-resolver": "1100.1.12",
+    "@pnpm/resolving.git-resolver": "1100.1.13",
     "is-subdir": "^2.0.0",
-    "p-limit": "^7.3.0",
-    "semver": "^7.8.4",
+    "p-limit": "^7.3.1",
+    "semver": "^7.8.5",
     "write-file-atomic": "^7.0.1",
     "yaml": "^2.9.0"
   },
@@ -41,7 +41,7 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/deps.github-actions": "1100.1.0",
+    "@pnpm/deps.github-actions": "1100.1.1",
     "@types/semver": "7.7.1",
     "@types/write-file-atomic": "^4.0.3"
   },