actions-up 1.14.1 → 1.14.2

package/dist/core/api/check-updates.js

@@ -1,9 +1,10 @@
-import { normalizeVersion as e } from "../versions/normalize-version.js";
-import { isSemverLike as t } from "../versions/is-semver-like.js";
-import { createGitHubClient as n } from "./create-github-client.js";
-import r from "semver";
-async function i(i, o, u) {
-	let d = u?.client ?? n(o), f = u?.includeBranches ?? !1, p = u?.style ?? "sha", m = i.filter((e) => e.type === "external" || e.type === "reusable-workflow");
+import { isSemverLike as e } from "../versions/is-semver-like.js";
+import { preserveTagFormat as t } from "../versions/preserve-tag-format.js";
+import { normalizeVersion as n } from "../versions/normalize-version.js";
+import { createGitHubClient as r } from "./create-github-client.js";
+import i from "semver";
+async function a(t, a, s) {
+	let d = s?.client ?? r(a), f = s?.includeBranches ?? !1, p = s?.style ?? "sha", m = t.filter((e) => e.type === "external" || e.type === "reusable-workflow");
 	if (m.length === 0) return [];
 	let h = /* @__PURE__ */ new Map();
 	for (let e of m) {
@@ -13,158 +14,158 @@ async function i(i, o, u) {
 	let g = {
 		rateLimitError: null,
 		rateLimitHit: !1
-	}, _ = await [...h.keys()].reduce((n, i) => n.then(async (n) => {
-		if (g.rateLimitHit) return [...n, {
+	}, _ = await [...h.keys()].reduce((t, r) => t.then(async (t) => {
+		if (g.rateLimitHit) return [...t, {
 			currentRefType: "unknown",
 			publishedAt: null,
 			version: null,
-			actionName: i,
+			actionName: r,
 			sha: null
 		}];
-		let a = i.split("/");
-		if (a.length < 2) return [...n, {
+		let a = r.split("/");
+		if (a.length < 2) return [...t, {
 			currentRefType: "unknown",
 			publishedAt: null,
 			version: null,
-			actionName: i,
+			actionName: r,
 			sha: null
 		}];
-		let [o, u] = a;
-		if (!o || !u) return [...n, {
+		let [o, s] = a;
+		if (!o || !s) return [...t, {
 			currentRefType: "unknown",
 			publishedAt: null,
 			version: null,
-			actionName: i,
+			actionName: r,
 			sha: null
 		}];
 		try {
-			let a = h.get(i)[0]?.version, p = c(a);
-			if (a && !s(a) && !t(a)) {
-				let e = await d.getRefType(o, u, a);
-				if (p = e === "branch" || e === "tag" ? e : p, e === "branch" && !f) return [...n, {
+			let a = h.get(r)[0]?.version, p = l(a);
+			if (a && !c(a) && !e(a)) {
+				let e = await d.getRefType(o, s, a);
+				if (p = e === "branch" || e === "tag" ? e : p, e === "branch" && !f) return [...t, {
 					currentRefType: p,
 					skipReason: "branch",
 					status: "skipped",
 					publishedAt: null,
 					version: null,
-					actionName: i,
+					actionName: r,
 					sha: null
 				}];
 			}
-			let m = await d.getLatestRelease(o, u);
+			let m = await d.getLatestRelease(o, s);
 			if (!m) {
-				let e = await d.getAllReleases(o, u, 1);
+				let e = await d.getAllReleases(o, s, 1);
 				m = e.find((e) => !e.isPrerelease) ?? e[0] ?? null;
 			}
 			if (m) {
-				let { publishedAt: a, version: s, sha: c } = m, f = !1;
+				let { publishedAt: a, version: c, sha: l } = m, f = !1;
 				{
-					let n = e(s), i = !!(s && s.trim() !== ""), a = i && /^v?\d+$/u.test(s.trim()), o = r.valid(n);
-					f = !i || a || !o || !t(s);
+					let t = n(c), r = !!(c && c.trim() !== ""), a = r && /^v?\d+$/u.test(c.trim()), o = i.valid(t);
+					f = !r || a || !o || !e(c);
 				}
 				if (f) {
-					let a = await d.getAllTags(o, u, 30);
+					let a = await d.getAllTags(o, s, 30);
 					if (a.length > 0) {
-						let c = a.filter((e) => t(e.tag)).map((t) => ({
-							v: r.valid(e(t.tag)),
-							raw: t
+						let l = a.filter((t) => e(t.tag)).map((e) => ({
+							v: i.valid(n(e.tag)),
+							raw: e
 						}));
-						if (c.length > 0) {
-							c.sort((e, t) => {
-								let n = r.rcompare(e.v, t.v);
+						if (l.length > 0) {
+							l.sort((e, t) => {
+								let n = i.rcompare(e.v, t.v);
 								if (n !== 0) return n;
-								let i = +!!/\d+\.\d+/u.test(e.raw.tag);
-								return +!!/\d+\.\d+/u.test(t.raw.tag) - i;
+								let r = +!!/\d+\.\d+/u.test(e.raw.tag);
+								return +!!/\d+\.\d+/u.test(t.raw.tag) - r;
 							});
-							let t = c[0].raw, a = r.valid(e(s) ?? void 0);
-							if (!a || r.gt(c[0].v, a) || r.eq(c[0].v, a) && /\d+\.\d+/u.test(t.tag)) {
-								let e = t.tag, r = t.sha?.length ? t.sha : null;
-								if (!r && e) try {
-									r = await d.getTagSha(o, u, e);
+							let e = l[0].raw, a = i.valid(n(c) ?? void 0);
+							if (!a || i.gt(l[0].v, a) || i.eq(l[0].v, a) && /\d+\.\d+/u.test(e.tag)) {
+								let n = e.tag, i = e.sha?.length ? e.sha : null;
+								if (!i && n) try {
+									i = await d.getTagSha(o, s, n);
 								} catch (e) {
-									if (l(e)) throw e;
+									if (u(e)) throw e;
 								}
-								return [...n, {
+								return [...t, {
 									currentRefType: p,
-									version: e,
+									version: n,
 									publishedAt: null,
-									sha: r,
-									actionName: i
+									sha: i,
+									actionName: r
 								}];
 							}
 						}
 					}
 				}
-				if (s) {
-					let e = c;
+				if (c) {
+					let e = l;
 					try {
-						c = await d.getTagSha(o, u, s) ?? e;
+						l = await d.getTagSha(o, s, c) ?? e;
 					} catch (t) {
-						if (l(t)) throw t;
-						c = e;
+						if (u(t)) throw t;
+						l = e;
 					}
 				}
-				return [...n, {
+				return [...t, {
 					currentRefType: p,
 					status: "ok",
 					publishedAt: a,
-					actionName: i,
-					version: s,
-					sha: c
+					actionName: r,
+					version: c,
+					sha: l
 				}];
 			}
-			let g = await d.getAllTags(o, u, 30);
+			let g = await d.getAllTags(o, s, 30);
 			if (g.length > 0) {
-				let a = g.filter((e) => t(e.tag)).map((t) => ({
-					v: r.valid(e(t.tag)),
-					raw: t
-				})), s;
+				let a = g.filter((t) => e(t.tag)).map((e) => ({
+					v: i.valid(n(e.tag)),
+					raw: e
+				})), c;
 				a.length > 0 ? (a.sort((e, t) => {
-					let n = r.rcompare(e.v, t.v);
+					let n = i.rcompare(e.v, t.v);
 					if (n !== 0) return n;
-					let i = +!!/\d+\.\d+/u.test(e.raw.tag);
-					return +!!/\d+\.\d+/u.test(t.raw.tag) - i;
-				}), s = a[0].raw) : s = g[0];
-				let c = s.tag, f = s.sha?.length ? s.sha : null;
-				if (!f && c) try {
-					f = await d.getTagSha(o, u, c);
+					let r = +!!/\d+\.\d+/u.test(e.raw.tag);
+					return +!!/\d+\.\d+/u.test(t.raw.tag) - r;
+				}), c = a[0].raw) : c = g[0];
+				let l = c.tag, f = c.sha?.length ? c.sha : null;
+				if (!f && l) try {
+					f = await d.getTagSha(o, s, l);
 				} catch (e) {
-					if (l(e)) throw e;
+					if (u(e)) throw e;
 				}
-				return [...n, {
+				return [...t, {
 					currentRefType: p,
 					status: "ok",
 					publishedAt: null,
-					actionName: i,
-					version: c,
+					actionName: r,
+					version: l,
 					sha: f
 				}];
 			}
-			return [...n, {
+			return [...t, {
 				currentRefType: p,
 				publishedAt: null,
 				version: null,
-				actionName: i,
+				actionName: r,
 				sha: null
 			}];
 		} catch (e) {
-			return e instanceof Error && e.name === "GitHubRateLimitError" ? (g.rateLimitHit = !0, g.rateLimitError = e, [...n, {
+			return e instanceof Error && e.name === "GitHubRateLimitError" ? (g.rateLimitHit = !0, g.rateLimitError = e, [...t, {
 				currentRefType: "unknown",
 				publishedAt: null,
 				version: null,
-				actionName: i,
+				actionName: r,
 				sha: null
-			}]) : (console.warn(`Failed to check ${i}:`, e), [...n, {
+			}]) : (console.warn(`Failed to check ${r}:`, e), [...t, {
 				currentRefType: "unknown",
 				publishedAt: null,
 				version: null,
-				actionName: i,
+				actionName: r,
 				sha: null
 			}]);
 		}
 	}), Promise.resolve([]));
 	if (g.rateLimitError) {
-		let e = !!(o ?? process.env.GITHUB_TOKEN), t = `${g.rateLimitError.message || "GitHub API rate limit exceeded."}\n${e ? "Wait for reset or reduce request rate." : "Please set GITHUB_TOKEN environment variable to increase the limit.\nSee: https://github.com/azat-io/actions-up?tab=readme-ov-file#github-token"}`, n = Error(t);
+		let e = !!(a ?? process.env.GITHUB_TOKEN), t = `${g.rateLimitError.message || "GitHub API rate limit exceeded."}\n${e ? "Wait for reset or reduce request rate." : "Please set GITHUB_TOKEN environment variable to increase the limit.\nSee: https://github.com/azat-io/actions-up?tab=readme-ov-file#github-token"}`, n = Error(t);
 		throw n.name = "GitHubRateLimitError", n;
 	}
 	let v = /* @__PURE__ */ new Map();
@@ -180,7 +181,7 @@ async function i(i, o, u) {
 	let y = [];
 	for (let e of m) {
 		let t = v.get(e.name);
-		t ? y.push(a(e, {
+		t ? y.push(o(e, {
 			publishedAt: t.publishedAt,
 			version: t.version,
 			sha: t.sha
@@ -189,68 +190,68 @@ async function i(i, o, u) {
 			skipReason: t.skipReason,
 			status: t.status,
 			style: p
-		})) : y.push(a(e, {
+		})) : y.push(o(e, {
 			publishedAt: null,
 			version: null,
 			sha: null
 		}, {
-			currentRefType: c(e.version),
+			currentRefType: l(e.version),
 			style: p
 		}));
 	}
 	return y;
 }
-function a(t, n, i) {
-	let { version: a, sha: c, publishedAt: l } = n, u = t.version ?? "unknown", d = e(u), f = a ? e(a) : null, p = i.currentRefType, { style: m } = i, h = i.status ?? "ok", g = i.skipReason, _ = !1, v = !1;
-	if (h === "skipped") return {
+function o(e, r, a) {
+	let { version: o, sha: l, publishedAt: u } = r, d = e.version ?? "unknown", f = n(d), p = a.currentRefType, { style: m } = a, h = (m === "preserve" && p === "tag" ? t(d, o) : null) ?? o, g = h ? n(h) : null, _ = a.status ?? "ok", v = a.skipReason, y = !1, b = !1;
+	if (_ === "skipped") return {
 		currentRefType: p,
-		currentVersion: u,
+		currentVersion: d,
 		isBreaking: !1,
 		hasUpdate: !1,
-		latestVersion: a,
-		publishedAt: l,
-		skipReason: g,
-		latestSha: c,
-		action: t,
-		status: h
+		latestVersion: o,
+		publishedAt: u,
+		skipReason: v,
+		latestSha: l,
+		action: e,
+		status: _
 	};
-	if (d && s(d)) c ? _ = !o(d, c) : f && (_ = !0);
-	else if (d && f) {
-		let e = r.valid(d), n = r.valid(f);
-		if (e && n) {
-			if (_ = r.lt(e, n), _) {
-				let t = r.major(e);
-				v = r.major(n) > t;
+	if (f && c(f)) l ? y = !s(f, l) : g && (y = !0);
+	else if (f && g) {
+		let t = i.valid(f), n = i.valid(g);
+		if (t && n) {
+			if (y = i.lt(t, n), y) {
+				let e = i.major(t);
+				b = i.major(n) > e;
 			}
-			!_ && r.eq(e, n) && !s(t.version) && c && m === "sha" && (_ = !0, v = !1);
-		} else d !== f && (_ = !0);
+			!y && i.eq(t, n) && !c(e.version) && l && m === "sha" && (y = !0, b = !1);
+		} else f !== g && (y = !0);
 	}
 	return {
 		currentRefType: p,
-		currentVersion: u,
-		latestVersion: a,
-		publishedAt: l,
-		isBreaking: v,
-		skipReason: g,
-		latestSha: c,
-		hasUpdate: _,
-		action: t,
-		status: h
+		currentVersion: d,
+		latestVersion: o,
+		publishedAt: u,
+		isBreaking: b,
+		skipReason: v,
+		latestSha: l,
+		hasUpdate: y,
+		action: e,
+		status: _
 	};
 }
-function o(e, t) {
+function s(e, t) {
 	let n = e.replace(/^v/u, ""), r = t.replace(/^v/u, ""), i = Math.min(n.length, r.length);
 	return i < 7 ? !1 : n.slice(0, Math.max(0, i)).toLowerCase() === r.slice(0, Math.max(0, i)).toLowerCase();
 }
-function s(e) {
+function c(e) {
 	if (!e) return !1;
 	let t = e.replace(/^v/u, "");
 	return /^[0-9a-f]{7,40}$/iu.test(t);
 }
-function c(e) {
-	return e ? s(e) ? "sha" : t(e) ? "tag" : "unknown" : "unknown";
+function l(t) {
+	return t ? c(t) ? "sha" : e(t) ? "tag" : "unknown" : "unknown";
 }
-function l(e) {
+function u(e) {
 	return e instanceof Error && e.name === "GitHubRateLimitError";
 }
-export { i as checkUpdates };
+export { a as checkUpdates };

package/dist/core/ast/update/apply-updates.js

@@ -15,7 +15,7 @@ async function n(n) {
 			function i(e) {
 				return e.replaceAll(/[$()*+\-./?[\\\]^{|}]/gu, String.raw`\$&`);
 			}
-			let o = i(e.action.name), s = e.currentVersion ? i(e.currentVersion) : "";
+			let o = i(e.action.name), s = e.currentVersion ? i(e.currentVersion) : "", c = s ? String.raw`(?=(?:['"]|[ \t\]}{,#]|$))` : "";
 			if (o.includes("\n") || o.includes("\r")) {
 				console.error(`Invalid action name: ${e.action.name}`);
 				continue;
@@ -32,8 +32,8 @@ async function n(n) {
 				console.error(`Invalid SHA format: ${t}`);
 				continue;
 			}
-			let c = String.raw`['"]?\buses\b['"]?\s*:\s*`, l = String.raw`(?:^[^\S\n]*(?:-[^\S\n]*)?|[{\[,][^\S\n]*)` + c, u = new RegExp(String.raw`(?<prefix>${l})` + String.raw`(?<quote>['"]?)` + String.raw`(?<name>${o})@${s}` + String.raw`\k<quote>` + String.raw`(?<after>[ \t\]}{,]*)` + String.raw`(?<comment>[^\S\r\n]*#[^\r\n]*)?`, "gm");
-			a = a.replace(u, (i, ...a) => {
+			let l = String.raw`['"]?\buses\b['"]?\s*:\s*`, u = String.raw`(?:^[^\S\n]*(?:-[^\S\n]*)?|[{\[,][^\S\n]*)` + l, d = new RegExp(String.raw`(?<prefix>${u})` + String.raw`(?<quote>['"]?)` + String.raw`(?<name>${o})@${s}${c}` + String.raw`\k<quote>` + String.raw`(?<after>[ \t\]}{,]*)` + String.raw`(?<comment>[^\S\r\n]*#[^\r\n]*)?`, "gm");
+			a = a.replace(d, (i, ...a) => {
 				let o = a.at(-3), c = a.at(-2), l = a.at(-1), u = c.indexOf("\n", o + i.length), d = (u === -1 ? c.slice(o + i.length) : c.slice(o + i.length, u)).trim().length > 0, f = l.after.endsWith(" ") ? "" : " ", p = "";
 				if (n === "sha") p = d && !l.comment && s !== "" ? "" : `${f}# ${e.latestVersion}`;
 				else if (l.comment && !r(l.comment)) {

package/dist/core/updates/resolve-target-reference.js

@@ -1,24 +1,35 @@
-function e(e, t) {
-	return e.hasUpdate ? t === "sha" || e.currentRefType === "sha" ? e.latestSha ? {
-		...e,
-		targetRef: e.latestSha,
-		targetRefStyle: "sha"
-	} : {
-		...e,
+import { preserveTagFormat as e } from "../versions/preserve-tag-format.js";
+function t(t, n) {
+	if (!t.hasUpdate) return {
+		...t,
 		targetRefStyle: null,
 		targetRef: null
-	} : e.currentRefType === "tag" && e.latestVersion ? {
-		...e,
-		targetRef: e.latestVersion,
-		targetRefStyle: "tag"
+	};
+	if (n === "sha" || t.currentRefType === "sha") return t.latestSha ? {
+		...t,
+		targetRef: t.latestSha,
+		targetRefStyle: "sha"
 	} : {
-		...e,
+		...t,
 		targetRefStyle: null,
 		targetRef: null
-	} : {
-		...e,
+	};
+	if (t.currentRefType === "tag" && t.latestVersion) {
+		let n = e(t.currentVersion, t.latestVersion);
+		return n ? {
+			...t,
+			targetRef: n,
+			targetRefStyle: "tag"
+		} : {
+			...t,
+			targetRefStyle: null,
+			targetRef: null
+		};
+	}
+	return {
+		...t,
 		targetRefStyle: null,
 		targetRef: null
 	};
 }
-export { e as resolveTargetReference };
+export { t as resolveTargetReference };

package/dist/core/versions/find-compatible-tag.js

@@ -1,14 +1,14 @@
-import { normalizeVersion as e } from "./normalize-version.js";
-import { isSemverLike as t } from "./is-semver-like.js";
+import { isSemverLike as e } from "./is-semver-like.js";
+import { normalizeVersion as t } from "./normalize-version.js";
 import n from "semver";
 function r(r, a, o) {
-	if (!a || !t(a) || r.length === 0) return null;
-	let s = n.valid(e(a));
+	if (!a || !e(a) || r.length === 0) return null;
+	let s = n.valid(t(a));
 	if (!s) return null;
 	let c = n.major(s), l = n.minor(s), u = [];
 	for (let i of r) {
-		if (!t(i.tag)) continue;
-		let r = n.valid(e(i.tag));
+		if (!e(i.tag)) continue;
+		let r = n.valid(t(i.tag));
 		r && n.gt(r, s) && n.major(r) === c && (o === "patch" && n.minor(r) !== l || u.push({
 			tag: i,
 			parsed: r

package/dist/core/versions/preserve-tag-format.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Preserve the semver granularity of the current tag when projecting a newer
+ * tag reference.
+ *
+ * Examples:
+ *
+ * - `v6` + `v7.0.2` -> `v7`
+ * - `v6.1` + `v6.2.3` -> `v6.2`
+ * - `v6.1.4` + `v6.2.3` -> `v6.2.3`.
+ *
+ * Returns null when the target tag cannot be preserved safely.
+ *
+ * @param currentVersion - Current tag reference found in the workflow.
+ * @param latestVersion - Latest resolved tag reference.
+ * @returns Preserved tag reference or null when preservation is unsafe.
+ */
+export declare function preserveTagFormat(currentVersion: undefined | string | null, latestVersion: undefined | string | null): string | null;

package/dist/core/versions/preserve-tag-format.js

@@ -0,0 +1,11 @@
+import { isSemverLike as e } from "./is-semver-like.js";
+function t(t, n) {
+	if (!t || !n) return null;
+	let r = t.trim(), i = n.trim();
+	if (!e(r) || !e(i)) return null;
+	let a = r.startsWith("v");
+	if (a !== i.startsWith("v")) return null;
+	let o = r.replace(/^v/u, "").split("."), s = i.replace(/^v/u, "").split(".");
+	return s.length < o.length ? null : `${a ? "v" : ""}${s.slice(0, o.length).join(".")}`;
+}
+export { t as preserveTagFormat };

package/dist/package.js

@@ -1,2 +1,2 @@
-var e = "1.14.1";
+var e = "1.14.2";
 export { e as version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "actions-up",
-  "version": "1.14.1",
+  "version": "1.14.2",
   "description": "Interactive CLI tool to update GitHub Actions with SHA pinning or preserved refs",
   "keywords": [
     "github-actions",
@@ -40,8 +40,8 @@
     "enquirer": "^2.4.1",
     "nanospinner": "^1.2.2",
     "picocolors": "^1.1.1",
-    "semver": "^7.7.4",
-    "yaml": "^2.8.3"
+    "semver": "^7.8.0",
+    "yaml": "^2.9.0"
   },
   "engines": {
     "node": "^18.0.0 || >=20.0.0"

package/readme.md

@@ -3,9 +3,8 @@
 <img
   src="https://raw.githubusercontent.com/azat-io/actions-up/main/assets/logo.svg"
   alt="Actions Up logo"
-  width="160"
-  height="160"
   align="right"
+  width="160"
 />
 
 [![Version](https://img.shields.io/npm/v/actions-up.svg?color=fff&labelColor=4493f8)](https://npmjs.com/package/actions-up)
@@ -102,7 +101,8 @@ Per-project
 npm install --save-dev actions-up
 ```
 
-Alternatively, you can install Actions Up with [Homebrew](https://brew.sh)
+Alternatively, you can install Actions Up with
+[Homebrew](https://formulae.brew.sh/formula/actions-up)
 
 ```bash
 brew install actions-up
@@ -214,9 +214,11 @@ Use `--style preserve` to keep the current reference style:
 npx actions-up --style preserve
 ```
 
-`preserve` keeps tag references on tags and SHA references on SHAs. For example,
-`actions/checkout@v5` updates to `actions/checkout@v6.0.2`, while a SHA-pinned
-action continues updating to the latest resolved SHA.
+`preserve` keeps tag references on tags and SHA references on SHAs. Tag refs
+also keep their granularity, so `actions/checkout@v5` updates to
+`actions/checkout@v6`, while `actions/checkout@v5.0` updates to
+`actions/checkout@v6.0`. A SHA-pinned action continues updating to the latest
+resolved SHA.
 
 ## GitHub Actions Integration