actions-up 1.14.1 → 1.14.3

package/dist/cli/index.js

@@ -17,192 +17,197 @@ import { mergeScanResults as h } from "./merge-scan-results.js";
 import { printModeWarning as g } from "./print-mode-warning.js";
 import { scanRecursive as _ } from "../core/scan-recursive.js";
 import { buildJsonReport as v } from "./build-json-report.js";
-import { scanGitHubActions as y } from "../core/scan-github-actions.js";
+import { parseArguments as y } from "./parse-arguments.js";
+import { scanGitHubActions as b } from "../core/scan-github-actions.js";
 import "../core/index.js";
-import { version as b } from "../package.js";
-import { createSpinner as x } from "nanospinner";
-import { resolve as S } from "node:path";
+import { version as x } from "../package.js";
+import { createSpinner as S } from "nanospinner";
+import { resolve as C } from "node:path";
 import "node:worker_threads";
-import C from "picocolors";
-import w from "cac";
+import w from "picocolors";
 function T() {
-	let T = w("actions-up");
-	T.help().version(b).option("--dir <directory>", "Directory to scan (repeatable). Default: .github, or . with --recursive").option("--dry-run", "Preview changes without applying them").option("--exclude <regex>", "Exclude actions by regex (repeatable)").option("--include-branches", "Also check actions pinned to branches (default: false)").option("--json", "Output update information as machine-readable JSON").option("--min-age <days>", "Minimum age in days for updates (default: 0)", { default: 0 }).option("--mode <mode>", "Update mode: major, minor, or patch (default: major)", { default: "major" }).option("--style <style>", "Update style: sha or preserve (default: sha)", { default: "sha" }).option("--recursive, -r", "Recursively scan directories for YAML files").option("--yes, -y", "Skip all confirmations").command("", "Update GitHub Actions").action(async (b) => {
-		let w = b.json ?? !1, T = null, E = o({
-			recursive: b.recursive,
-			cwd: process.cwd(),
-			dir: b.dir
-		}), D = E.map(({ root: e, dir: t }) => S(e, t)), O = b.includeBranches ?? !1, k = d(b.mode), A = l(b.style), j = [];
-		Array.isArray(b.exclude) ? j.push(...b.exclude) : typeof b.exclude == "string" && j.push(b.exclude);
-		let M = j.flatMap((e) => e.split(",")).map((e) => e.trim()).filter(Boolean);
-		try {
-			f({
-				yes: b.yes,
-				json: w
-			}), w || (console.info(C.cyan("\n🚀 Actions Up!\n")), T = x("Scanning GitHub Actions...").start());
-			function o({ actionsToCheckCount: e, blockedByMode: t = [], outdated: n = [], skipped: r = [], scanResult: i, status: a }) {
-				process.stdout.write(`${JSON.stringify(v({
-					recursive: b.recursive ?? !1,
-					excludePatterns: M,
-					directories: D,
-					minAge: b.minAge,
-					actionsToCheckCount: e,
-					includeBranches: O,
-					blockedByMode: t,
-					scanResult: i,
-					outdated: n,
-					skipped: r,
-					status: a,
-					style: A,
-					mode: k
-				}), null, 2)}\n`);
-			}
-			let l = h(b.recursive ? await Promise.all(E.map(({ root: e, dir: t }) => _(e, t))) : await Promise.all(E.map(({ root: e, dir: t }) => y(e, t)))), d = l.actions.length, S = l.workflows.size, j = l.compositeActions.size;
-			if (T?.success(`Found ${C.yellow(d)} actions in ${C.yellow(S)} workflows and ${C.yellow(j)} composite actions`), d === 0) {
-				if (w) {
-					o({
-						status: "no-actions-found",
-						actionsToCheckCount: 0,
-						scanResult: l
-					});
-					return;
-				}
-				console.info(C.green("\n✨ No GitHub Actions found in this repository"));
+	let e = y(process.argv.slice(2), x);
+	if (e.kind === "help" || e.kind === "version") {
+		console.info(e.text);
+		return;
+	}
+	e.kind === "error" && (console.error(w.redBright("\nError:"), e.message), process.exit(1)), E(e.options);
+}
+async function E(y) {
+	let x = y.json ?? !1, T = null, E = o({
+		recursive: y.recursive,
+		cwd: process.cwd(),
+		dir: y.dir
+	}), D = E.map(({ root: e, dir: t }) => C(e, t)), O = y.includeBranches ?? !1, k = d(y.mode), A = l(y.style), j = [];
+	Array.isArray(y.exclude) ? j.push(...y.exclude) : typeof y.exclude == "string" && j.push(y.exclude);
+	let M = j.flatMap((e) => e.split(",")).map((e) => e.trim()).filter(Boolean);
+	try {
+		f({
+			yes: y.yes,
+			json: x
+		}), x || (console.info(w.cyan("\n🚀 Actions Up!\n")), T = S("Scanning GitHub Actions...").start());
+		function o({ actionsToCheckCount: e, blockedByMode: t = [], outdated: n = [], skipped: r = [], scanResult: i, status: a }) {
+			process.stdout.write(`${JSON.stringify(v({
+				recursive: y.recursive ?? !1,
+				excludePatterns: M,
+				directories: D,
+				minAge: y.minAge,
+				actionsToCheckCount: e,
+				includeBranches: O,
+				blockedByMode: t,
+				scanResult: i,
+				outdated: n,
+				skipped: r,
+				status: a,
+				style: A,
+				mode: k
+			}), null, 2)}\n`);
+		}
+		let l = h(y.recursive ? await Promise.all(E.map(({ root: e, dir: t }) => _(e, t))) : await Promise.all(E.map(({ root: e, dir: t }) => b(e, t)))), d = l.actions.length, C = l.workflows.size, j = l.compositeActions.size;
+		if (T?.success(`Found ${w.yellow(d)} actions in ${w.yellow(C)} workflows and ${w.yellow(j)} composite actions`), d === 0) {
+			if (x) {
+				o({
+					status: "no-actions-found",
+					actionsToCheckCount: 0,
+					scanResult: l
+				});
 				return;
 			}
-			let N = l.actions;
-			if (M.length > 0) {
-				let { parseExcludePatterns: e } = await import("../core/filters/parse-exclude-patterns.js"), t = e(M);
-				t.length > 0 && (N = N.filter((e) => {
-					let { name: n } = e;
-					for (let e of t) if (e.test(n)) return !1;
-					return !0;
-				}));
-			}
-			if (w || (T = x("Checking for updates...").start()), N.length === 0) {
-				if (T?.success("No actions to check after excludes"), w) {
-					o({
-						status: "nothing-to-check",
-						actionsToCheckCount: 0,
-						scanResult: l
-					});
-					return;
-				}
-				console.info(C.green("\n✨ Nothing to check after excludes\n"));
+			console.info(w.green("\n✨ No GitHub Actions found in this repository"));
+			return;
+		}
+		let N = l.actions;
+		if (M.length > 0) {
+			let { parseExcludePatterns: e } = await import("../core/filters/parse-exclude-patterns.js"), t = e(M);
+			t.length > 0 && (N = N.filter((e) => {
+				let { name: n } = e;
+				for (let e of t) if (e.test(n)) return !1;
+				return !0;
+			}));
+		}
+		if (x || (T = S("Checking for updates...").start()), N.length === 0) {
+			if (T?.success("No actions to check after excludes"), x) {
+				o({
+					status: "nothing-to-check",
+					actionsToCheckCount: 0,
+					scanResult: l
+				});
 				return;
 			}
-			let P = process.env.GITHUB_TOKEN, F = a(P), I = await m(N, P, {
-				client: F,
-				includeBranches: O,
-				style: A
-			}), L = [];
-			await Promise.all(I.map(async (e) => {
-				await p(e.action.file, e.action.line) || L.push(e);
-			}));
-			let R = L.filter((e) => e.status === "skipped"), z = L.filter((e) => e.hasUpdate), B = b.minAge * 24 * 60 * 60 * 1e3, V = Date.now();
-			z = z.filter((e) => e.publishedAt ? V - e.publishedAt.getTime() >= B : !0);
-			let H = [];
-			if (k !== "major") {
-				let n = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Map(), o = await Promise.all(z.map(async (n) => {
-					let r = n.currentVersion;
-					if (t(n.currentVersion)) {
-						let t = await e(n.action.file, n.action.line, a);
-						t && (r = t);
-					}
-					let i = s(r, n.latestVersion);
-					return {
-						effectiveCurrentVersion: r,
-						allowed: k === "minor" ? i === "minor" || i === "patch" || i === "none" : i === "patch" || i === "none",
-						update: n
-					};
-				})), c = [], l = await Promise.all(o.map(async (e) => {
-					if (e.allowed) return { update: e.update };
-					let t = await i(F, {
-						currentVersion: e.effectiveCurrentVersion,
-						actionName: e.update.action.name,
-						tagsCache: n,
-						shaCache: r,
-						mode: k
-					});
-					return t ? { update: {
-						...e.update,
-						latestVersion: t.version,
-						latestSha: t.sha,
-						isBreaking: !1,
-						hasUpdate: !0
-					} } : { blocked: e.update };
-				}));
-				for (let e of l) {
-					if (e.update) {
-						c.push(e.update);
-						continue;
-					}
-					H.push(e.blocked);
+			console.info(w.green("\n✨ Nothing to check after excludes\n"));
+			return;
+		}
+		let P = process.env.GITHUB_TOKEN, F = a(P), I = await m(N, P, {
+			client: F,
+			includeBranches: O,
+			style: A
+		}), L = [];
+		await Promise.all(I.map(async (e) => {
+			await p(e.action.file, e.action.line) || L.push(e);
+		}));
+		let R = L.filter((e) => e.status === "skipped"), z = L.filter((e) => e.hasUpdate), B = y.minAge * 24 * 60 * 60 * 1e3, V = Date.now();
+		z = z.filter((e) => e.publishedAt ? V - e.publishedAt.getTime() >= B : !0);
+		let H = [];
+		if (k !== "major") {
+			let n = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Map(), a = /* @__PURE__ */ new Map(), o = await Promise.all(z.map(async (n) => {
+				let r = n.currentVersion;
+				if (t(n.currentVersion)) {
+					let t = await e(n.action.file, n.action.line, a);
+					t && (r = t);
 				}
-				z = c;
-			}
-			z = z.map((e) => r(e, A));
-			let U = z.filter((e) => !e.targetRef).map((e) => ({
-				...e,
-				skipReason: "unsupported-style",
-				status: "skipped",
-				hasUpdate: !1
+				let i = s(r, n.latestVersion);
+				return {
+					effectiveCurrentVersion: r,
+					allowed: k === "minor" ? i === "minor" || i === "patch" || i === "none" : i === "patch" || i === "none",
+					update: n
+				};
+			})), c = [], l = await Promise.all(o.map(async (e) => {
+				if (e.allowed) return { update: e.update };
+				let t = await i(F, {
+					currentVersion: e.effectiveCurrentVersion,
+					actionName: e.update.action.name,
+					tagsCache: n,
+					shaCache: r,
+					mode: k
+				});
+				return t ? { update: {
+					...e.update,
+					latestVersion: t.version,
+					latestSha: t.sha,
+					isBreaking: !1,
+					hasUpdate: !0
+				} } : { blocked: e.update };
 			}));
-			R.push(...U), z = z.filter((e) => e.targetRef);
-			let W = z.filter((e) => e.isBreaking);
-			if (z.length === 0) {
-				if (T?.success("All actions are up to date!"), w) {
-					o({
-						actionsToCheckCount: N.length,
-						status: "up-to-date",
-						blockedByMode: H,
-						scanResult: l,
-						skipped: R
-					});
-					return;
+			for (let e of l) {
+				if (e.update) {
+					c.push(e.update);
+					continue;
 				}
-				R.length > 0 && u(R, O, A), H.length > 0 && g(H, k), console.info(C.green("\n✨ Everything is already at the latest version!\n"));
-				return;
+				H.push(e.blocked);
 			}
-			if (T?.success(`Found ${C.yellow(z.length)} updates available${W.length > 0 ? ` (${C.redBright(W.length)} breaking)` : ""}`), w) {
+			z = c;
+		}
+		z = z.map((e) => r(e, A));
+		let U = z.filter((e) => !e.targetRef).map((e) => ({
+			...e,
+			skipReason: "unsupported-style",
+			status: "skipped",
+			hasUpdate: !1
+		}));
+		R.push(...U), z = z.filter((e) => e.targetRef);
+		let W = z.filter((e) => e.isBreaking);
+		if (z.length === 0) {
+			if (T?.success("All actions are up to date!"), x) {
 				o({
 					actionsToCheckCount: N.length,
-					status: "updates-available",
+					status: "up-to-date",
 					blockedByMode: H,
 					scanResult: l,
-					outdated: z,
 					skipped: R
 				});
 				return;
 			}
-			if (R.length > 0 && u(R, O, A), H.length > 0 && g(H, k), b.dryRun) {
-				console.info(C.yellow("\n📋 Dry Run - No changes will be made\n"));
-				for (let e of z) {
-					let t = e.targetRefStyle === "sha" && e.targetRef ? `${e.latestVersion} ${C.gray(`(${e.targetRef.slice(0, 7)})`)}` : e.targetRef ?? e.latestVersion;
-					console.info(`${C.cyan(e.action.file ?? "unknown")}:\n${e.action.name}: ${C.redBright(e.currentVersion)} → ${C.green(t)}\n`);
-				}
-				console.info(C.gray(`\n${z.length} actions would be updated\n`));
+			R.length > 0 && u(R, O, A), H.length > 0 && g(H, k), console.info(w.green("\n✨ Everything is already at the latest version!\n"));
+			return;
+		}
+		if (T?.success(`Found ${w.yellow(z.length)} updates available${W.length > 0 ? ` (${w.redBright(W.length)} breaking)` : ""}`), x) {
+			o({
+				actionsToCheckCount: N.length,
+				status: "updates-available",
+				blockedByMode: H,
+				scanResult: l,
+				outdated: z,
+				skipped: R
+			});
+			return;
+		}
+		if (R.length > 0 && u(R, O, A), H.length > 0 && g(H, k), y.dryRun) {
+			console.info(w.yellow("\n📋 Dry Run - No changes will be made\n"));
+			for (let e of z) {
+				let t = e.targetRefStyle === "sha" && e.targetRef ? `${e.latestVersion} ${w.gray(`(${e.targetRef.slice(0, 7)})`)}` : e.targetRef ?? e.latestVersion;
+				console.info(`${w.cyan(e.action.file ?? "unknown")}:\n${e.action.name}: ${w.redBright(e.currentVersion)} → ${w.green(t)}\n`);
+			}
+			console.info(w.gray(`\n${z.length} actions would be updated\n`));
+			return;
+		}
+		if (y.yes) {
+			let e = z.filter((e) => e.targetRef);
+			if (e.length === 0) {
+				console.info(w.yellow("\n⚠️ No actionable updates available\n"));
 				return;
 			}
-			if (b.yes) {
-				let e = z.filter((e) => e.targetRef);
-				if (e.length === 0) {
-					console.info(C.yellow("\n⚠️ No actionable updates available\n"));
-					return;
-				}
-				console.info(C.yellow(`\n🔄 Updating ${e.length} actions...\n`)), await c(e), console.info(C.green("\n✓ Updates applied successfully!"));
-			} else {
-				(R.length > 0 || H.length > 0) && console.info("");
-				let e = await n(z, { showAge: b.minAge > 0 });
-				if (!e || e.length === 0) {
-					console.info(C.gray("\nNo updates applied"));
-					return;
-				}
-				console.info(C.yellow(`\n🔄 Updating ${e.length} selected actions...\n`)), await c(e), console.info(C.green("\n✓ Updates applied successfully!"));
+			console.info(w.yellow(`\n🔄 Updating ${e.length} actions...\n`)), await c(e), console.info(w.green("\n✓ Updates applied successfully!"));
+		} else {
+			(R.length > 0 || H.length > 0) && console.info("");
+			let e = await n(z, { showAge: y.minAge > 0 });
+			if (!e || e.length === 0) {
+				console.info(w.gray("\nNo updates applied"));
+				return;
 			}
-		} catch (e) {
-			T?.error("Failed"), e instanceof Error && e.name === "GitHubRateLimitError" ? (console.error(C.yellow("\n⚠️ Rate Limit Exceeded\n")), console.error(e.message), console.error(C.gray("\nExample: GITHUB_TOKEN=ghp_xxxx actions-up\n"))) : console.error(C.redBright("\nError:"), e instanceof Error ? e.message : String(e)), process.exit(1);
+			console.info(w.yellow(`\n🔄 Updating ${e.length} selected actions...\n`)), await c(e), console.info(w.green("\n✓ Updates applied successfully!"));
 		}
-	}), T.parse();
+	} catch (e) {
+		T?.error("Failed"), e instanceof Error && e.name === "GitHubRateLimitError" ? (console.error(w.yellow("\n⚠️ Rate Limit Exceeded\n")), console.error(e.message), console.error(w.gray("\nExample: GITHUB_TOKEN=ghp_xxxx actions-up\n"))) : console.error(w.redBright("\nError:"), e instanceof Error ? e.message : String(e)), process.exit(1);
+	}
 }
 export { T as run };

package/dist/cli/parse-arguments.d.ts

@@ -0,0 +1,74 @@
+/**
+ * CLI Options.
+ */
+export interface CLIOptions {
+    /**
+     * Regex patterns to exclude actions by name (repeatable).
+     */
+    exclude?: string[] | string;
+    /**
+     * Whether to include branch references in update checks.
+     */
+    includeBranches?: boolean;
+    /**
+     * Custom directory name (e.g., '.gitea' instead of '.github').
+     */
+    dir?: string[] | string;
+    /**
+     * Recursively scan directories for YAML files.
+     */
+    recursive?: boolean;
+    /**
+     * Preview changes without applying them.
+     */
+    dryRun: boolean;
+    /**
+     * Update style (sha or preserve).
+     */
+    style?: string;
+    /**
+     * Output a machine-readable JSON report.
+     */
+    json?: boolean;
+    /**
+     * Minimum age in days for updates.
+     */
+    minAge: number;
+    /**
+     * Update mode (major, minor, patch).
+     */
+    mode?: string;
+    /**
+     * Skip all confirmations.
+     */
+    yes: boolean;
+}
+/**
+ * Result of parsing CLI arguments. `kind` discriminates what the caller should
+ * do next.
+ */
+export type ParseArgumentsResult = {
+    options: CLIOptions;
+    kind: 'options';
+} | {
+    message: string;
+    kind: 'error';
+} | {
+    kind: 'version';
+    text: string;
+} | {
+    kind: 'help';
+    text: string;
+};
+/**
+ * Parse CLI arguments into normalized options.
+ *
+ * Reproduces the previous cac behavior without its runtime magic: numeric
+ * coercion for `--min-age` and the option defaults are applied manually here,
+ * and kebab-case flags are mapped to the camelCase option shape.
+ *
+ * @param argv - Raw arguments, typically `process.argv.slice(2)`.
+ * @param appVersion - Version string used for `--version`.
+ * @returns A discriminated result describing what the caller should do.
+ */
+export declare function parseArguments(argv: string[], appVersion: string): ParseArgumentsResult;

package/dist/cli/parse-arguments.js

@@ -0,0 +1,76 @@
+import { parseArgs as e } from "node:util";
+var t = "Usage:\n  $ actions-up [options]\n\nOptions:\n  --dir <directory>   Directory to scan (repeatable). Default: .github, or . with --recursive\n  --dry-run           Preview changes without applying them\n  --exclude <regex>   Exclude actions by regex (repeatable)\n  --include-branches  Also check actions pinned to branches (default: false)\n  --json              Output update information as machine-readable JSON\n  --min-age <days>    Minimum age in days for updates (default: 0)\n  --mode <mode>       Update mode: major, minor, or patch (default: major)\n  --style <style>     Update style: sha or preserve (default: sha)\n  -r, --recursive     Recursively scan directories for YAML files\n  -y, --yes           Skip all confirmations\n  -h, --help          Display this message\n  -v, --version       Display version number", n = {
+	exclude: {
+		type: "string",
+		multiple: !0
+	},
+	recursive: {
+		type: "boolean",
+		short: "r"
+	},
+	version: {
+		type: "boolean",
+		short: "v"
+	},
+	"include-branches": { type: "boolean" },
+	dir: {
+		type: "string",
+		multiple: !0
+	},
+	help: {
+		type: "boolean",
+		short: "h"
+	},
+	yes: {
+		type: "boolean",
+		short: "y"
+	},
+	"dry-run": { type: "boolean" },
+	"min-age": { type: "string" },
+	style: { type: "string" },
+	json: { type: "boolean" },
+	mode: { type: "string" }
+};
+function r(r, i) {
+	try {
+		let { values: a } = e({
+			allowPositionals: !1,
+			options: n,
+			strict: !0,
+			args: r
+		});
+		if (a.help) return {
+			text: t,
+			kind: "help"
+		};
+		if (a.version) return {
+			text: `actions-up/${i} ${process.platform}-${process.arch} node-${process.version}`,
+			kind: "version"
+		};
+		let o = a["min-age"], s = o === void 0 ? 0 : Number(o);
+		return !Number.isFinite(s) || s < 0 ? {
+			message: `Invalid --min-age "${o}". Expected a non-negative number.`,
+			kind: "error"
+		} : {
+			options: {
+				includeBranches: a["include-branches"],
+				dryRun: a["dry-run"] ?? !1,
+				style: a.style ?? "sha",
+				mode: a.mode ?? "major",
+				recursive: a.recursive,
+				yes: a.yes ?? !1,
+				exclude: a.exclude,
+				json: a.json,
+				dir: a.dir,
+				minAge: s
+			},
+			kind: "options"
+		};
+	} catch (e) {
+		return {
+			message: e.message,
+			kind: "error"
+		};
+	}
+}
+export { r as parseArguments };

package/dist/core/api/check-updates.js

@@ -1,9 +1,10 @@
-import { normalizeVersion as e } from "../versions/normalize-version.js";
-import { isSemverLike as t } from "../versions/is-semver-like.js";
-import { createGitHubClient as n } from "./create-github-client.js";
-import r from "semver";
-async function i(i, o, u) {
-	let d = u?.client ?? n(o), f = u?.includeBranches ?? !1, p = u?.style ?? "sha", m = i.filter((e) => e.type === "external" || e.type === "reusable-workflow");
+import { isSemverLike as e } from "../versions/is-semver-like.js";
+import { preserveTagFormat as t } from "../versions/preserve-tag-format.js";
+import { normalizeVersion as n } from "../versions/normalize-version.js";
+import { createGitHubClient as r } from "./create-github-client.js";
+import i from "semver";
+async function a(t, a, s) {
+	let d = s?.client ?? r(a), f = s?.includeBranches ?? !1, p = s?.style ?? "sha", m = t.filter((e) => e.type === "external" || e.type === "reusable-workflow");
 	if (m.length === 0) return [];
 	let h = /* @__PURE__ */ new Map();
 	for (let e of m) {
@@ -13,158 +14,158 @@ async function i(i, o, u) {
 	let g = {
 		rateLimitError: null,
 		rateLimitHit: !1
-	}, _ = await [...h.keys()].reduce((n, i) => n.then(async (n) => {
-		if (g.rateLimitHit) return [...n, {
+	}, _ = await [...h.keys()].reduce((t, r) => t.then(async (t) => {
+		if (g.rateLimitHit) return [...t, {
 			currentRefType: "unknown",
 			publishedAt: null,
 			version: null,
-			actionName: i,
+			actionName: r,
 			sha: null
 		}];
-		let a = i.split("/");
-		if (a.length < 2) return [...n, {
+		let a = r.split("/");
+		if (a.length < 2) return [...t, {
 			currentRefType: "unknown",
 			publishedAt: null,
 			version: null,
-			actionName: i,
+			actionName: r,
 			sha: null
 		}];
-		let [o, u] = a;
-		if (!o || !u) return [...n, {
+		let [o, s] = a;
+		if (!o || !s) return [...t, {
 			currentRefType: "unknown",
 			publishedAt: null,
 			version: null,
-			actionName: i,
+			actionName: r,
 			sha: null
 		}];
 		try {
-			let a = h.get(i)[0]?.version, p = c(a);
-			if (a && !s(a) && !t(a)) {
-				let e = await d.getRefType(o, u, a);
-				if (p = e === "branch" || e === "tag" ? e : p, e === "branch" && !f) return [...n, {
+			let a = h.get(r)[0]?.version, p = l(a);
+			if (a && !c(a) && !e(a)) {
+				let e = await d.getRefType(o, s, a);
+				if (p = e === "branch" || e === "tag" ? e : p, e === "branch" && !f) return [...t, {
 					currentRefType: p,
 					skipReason: "branch",
 					status: "skipped",
 					publishedAt: null,
 					version: null,
-					actionName: i,
+					actionName: r,
 					sha: null
 				}];
 			}
-			let m = await d.getLatestRelease(o, u);
+			let m = await d.getLatestRelease(o, s);
 			if (!m) {
-				let e = await d.getAllReleases(o, u, 1);
+				let e = await d.getAllReleases(o, s, 1);
 				m = e.find((e) => !e.isPrerelease) ?? e[0] ?? null;
 			}
 			if (m) {
-				let { publishedAt: a, version: s, sha: c } = m, f = !1;
+				let { publishedAt: a, version: c, sha: l } = m, f = !1;
 				{
-					let n = e(s), i = !!(s && s.trim() !== ""), a = i && /^v?\d+$/u.test(s.trim()), o = r.valid(n);
-					f = !i || a || !o || !t(s);
+					let t = n(c), r = !!(c && c.trim() !== ""), a = r && /^v?\d+$/u.test(c.trim()), o = i.valid(t);
+					f = !r || a || !o || !e(c);
 				}
 				if (f) {
-					let a = await d.getAllTags(o, u, 30);
+					let a = await d.getAllTags(o, s, 30);
 					if (a.length > 0) {
-						let c = a.filter((e) => t(e.tag)).map((t) => ({
-							v: r.valid(e(t.tag)),
-							raw: t
+						let l = a.filter((t) => e(t.tag)).map((e) => ({
+							v: i.valid(n(e.tag)),
+							raw: e
 						}));
-						if (c.length > 0) {
-							c.sort((e, t) => {
-								let n = r.rcompare(e.v, t.v);
+						if (l.length > 0) {
+							l.sort((e, t) => {
+								let n = i.rcompare(e.v, t.v);
 								if (n !== 0) return n;
-								let i = +!!/\d+\.\d+/u.test(e.raw.tag);
-								return +!!/\d+\.\d+/u.test(t.raw.tag) - i;
+								let r = +!!/\d+\.\d+/u.test(e.raw.tag);
+								return +!!/\d+\.\d+/u.test(t.raw.tag) - r;
 							});
-							let t = c[0].raw, a = r.valid(e(s) ?? void 0);
-							if (!a || r.gt(c[0].v, a) || r.eq(c[0].v, a) && /\d+\.\d+/u.test(t.tag)) {
-								let e = t.tag, r = t.sha?.length ? t.sha : null;
-								if (!r && e) try {
-									r = await d.getTagSha(o, u, e);
+							let e = l[0].raw, a = i.valid(n(c) ?? void 0);
+							if (!a || i.gt(l[0].v, a) || i.eq(l[0].v, a) && /\d+\.\d+/u.test(e.tag)) {
+								let n = e.tag, i = e.sha?.length ? e.sha : null;
+								if (!i && n) try {
+									i = await d.getTagSha(o, s, n);
 								} catch (e) {
-									if (l(e)) throw e;
+									if (u(e)) throw e;
 								}
-								return [...n, {
+								return [...t, {
 									currentRefType: p,
-									version: e,
+									version: n,
 									publishedAt: null,
-									sha: r,
-									actionName: i
+									sha: i,
+									actionName: r
 								}];
 							}
 						}
 					}
 				}
-				if (s) {
-					let e = c;
+				if (c) {
+					let e = l;
 					try {
-						c = await d.getTagSha(o, u, s) ?? e;
+						l = await d.getTagSha(o, s, c) ?? e;
 					} catch (t) {
-						if (l(t)) throw t;
-						c = e;
+						if (u(t)) throw t;
+						l = e;
 					}
 				}
-				return [...n, {
+				return [...t, {
 					currentRefType: p,
 					status: "ok",
 					publishedAt: a,
-					actionName: i,
-					version: s,
-					sha: c
+					actionName: r,
+					version: c,
+					sha: l
 				}];
 			}
-			let g = await d.getAllTags(o, u, 30);
+			let g = await d.getAllTags(o, s, 30);
 			if (g.length > 0) {
-				let a = g.filter((e) => t(e.tag)).map((t) => ({
-					v: r.valid(e(t.tag)),
-					raw: t
-				})), s;
+				let a = g.filter((t) => e(t.tag)).map((e) => ({
+					v: i.valid(n(e.tag)),
+					raw: e
+				})), c;
 				a.length > 0 ? (a.sort((e, t) => {
-					let n = r.rcompare(e.v, t.v);
+					let n = i.rcompare(e.v, t.v);
 					if (n !== 0) return n;
-					let i = +!!/\d+\.\d+/u.test(e.raw.tag);
-					return +!!/\d+\.\d+/u.test(t.raw.tag) - i;
-				}), s = a[0].raw) : s = g[0];
-				let c = s.tag, f = s.sha?.length ? s.sha : null;
-				if (!f && c) try {
-					f = await d.getTagSha(o, u, c);
+					let r = +!!/\d+\.\d+/u.test(e.raw.tag);
+					return +!!/\d+\.\d+/u.test(t.raw.tag) - r;
+				}), c = a[0].raw) : c = g[0];
+				let l = c.tag, f = c.sha?.length ? c.sha : null;
+				if (!f && l) try {
+					f = await d.getTagSha(o, s, l);
 				} catch (e) {
-					if (l(e)) throw e;
+					if (u(e)) throw e;
 				}
-				return [...n, {
+				return [...t, {
 					currentRefType: p,
 					status: "ok",
 					publishedAt: null,
-					actionName: i,
-					version: c,
+					actionName: r,
+					version: l,
 					sha: f
 				}];
 			}
-			return [...n, {
+			return [...t, {
 				currentRefType: p,
 				publishedAt: null,
 				version: null,
-				actionName: i,
+				actionName: r,
 				sha: null
 			}];
 		} catch (e) {
-			return e instanceof Error && e.name === "GitHubRateLimitError" ? (g.rateLimitHit = !0, g.rateLimitError = e, [...n, {
+			return e instanceof Error && e.name === "GitHubRateLimitError" ? (g.rateLimitHit = !0, g.rateLimitError = e, [...t, {
 				currentRefType: "unknown",
 				publishedAt: null,
 				version: null,
-				actionName: i,
+				actionName: r,
 				sha: null
-			}]) : (console.warn(`Failed to check ${i}:`, e), [...n, {
+			}]) : (console.warn(`Failed to check ${r}:`, e), [...t, {
 				currentRefType: "unknown",
 				publishedAt: null,
 				version: null,
-				actionName: i,
+				actionName: r,
 				sha: null
 			}]);
 		}
 	}), Promise.resolve([]));
 	if (g.rateLimitError) {
-		let e = !!(o ?? process.env.GITHUB_TOKEN), t = `${g.rateLimitError.message || "GitHub API rate limit exceeded."}\n${e ? "Wait for reset or reduce request rate." : "Please set GITHUB_TOKEN environment variable to increase the limit.\nSee: https://github.com/azat-io/actions-up?tab=readme-ov-file#github-token"}`, n = Error(t);
+		let e = !!(a ?? process.env.GITHUB_TOKEN), t = `${g.rateLimitError.message || "GitHub API rate limit exceeded."}\n${e ? "Wait for reset or reduce request rate." : "Please set GITHUB_TOKEN environment variable to increase the limit.\nSee: https://github.com/azat-io/actions-up?tab=readme-ov-file#github-token"}`, n = Error(t);
 		throw n.name = "GitHubRateLimitError", n;
 	}
 	let v = /* @__PURE__ */ new Map();
@@ -180,7 +181,7 @@ async function i(i, o, u) {
 	let y = [];
 	for (let e of m) {
 		let t = v.get(e.name);
-		t ? y.push(a(e, {
+		t ? y.push(o(e, {
 			publishedAt: t.publishedAt,
 			version: t.version,
 			sha: t.sha
@@ -189,68 +190,68 @@ async function i(i, o, u) {
 			skipReason: t.skipReason,
 			status: t.status,
 			style: p
-		})) : y.push(a(e, {
+		})) : y.push(o(e, {
 			publishedAt: null,
 			version: null,
 			sha: null
 		}, {
-			currentRefType: c(e.version),
+			currentRefType: l(e.version),
 			style: p
 		}));
 	}
 	return y;
 }
-function a(t, n, i) {
-	let { version: a, sha: c, publishedAt: l } = n, u = t.version ?? "unknown", d = e(u), f = a ? e(a) : null, p = i.currentRefType, { style: m } = i, h = i.status ?? "ok", g = i.skipReason, _ = !1, v = !1;
-	if (h === "skipped") return {
+function o(e, r, a) {
+	let { version: o, sha: l, publishedAt: u } = r, d = e.version ?? "unknown", f = n(d), p = a.currentRefType, { style: m } = a, h = (m === "preserve" && p === "tag" ? t(d, o) : null) ?? o, g = h ? n(h) : null, _ = a.status ?? "ok", v = a.skipReason, y = !1, b = !1;
+	if (_ === "skipped") return {
 		currentRefType: p,
-		currentVersion: u,
+		currentVersion: d,
 		isBreaking: !1,
 		hasUpdate: !1,
-		latestVersion: a,
-		publishedAt: l,
-		skipReason: g,
-		latestSha: c,
-		action: t,
-		status: h
+		latestVersion: o,
+		publishedAt: u,
+		skipReason: v,
+		latestSha: l,
+		action: e,
+		status: _
 	};
-	if (d && s(d)) c ? _ = !o(d, c) : f && (_ = !0);
-	else if (d && f) {
-		let e = r.valid(d), n = r.valid(f);
-		if (e && n) {
-			if (_ = r.lt(e, n), _) {
-				let t = r.major(e);
-				v = r.major(n) > t;
+	if (f && c(f)) l ? y = !s(f, l) : g && (y = !0);
+	else if (f && g) {
+		let t = i.valid(f), n = i.valid(g);
+		if (t && n) {
+			if (y = i.lt(t, n), y) {
+				let e = i.major(t);
+				b = i.major(n) > e;
 			}
-			!_ && r.eq(e, n) && !s(t.version) && c && m === "sha" && (_ = !0, v = !1);
-		} else d !== f && (_ = !0);
+			!y && i.eq(t, n) && !c(e.version) && l && m === "sha" && (y = !0, b = !1);
+		} else f !== g && (y = !0);
 	}
 	return {
 		currentRefType: p,
-		currentVersion: u,
-		latestVersion: a,
-		publishedAt: l,
-		isBreaking: v,
-		skipReason: g,
-		latestSha: c,
-		hasUpdate: _,
-		action: t,
-		status: h
+		currentVersion: d,
+		latestVersion: o,
+		publishedAt: u,
+		isBreaking: b,
+		skipReason: v,
+		latestSha: l,
+		hasUpdate: y,
+		action: e,
+		status: _
 	};
 }
-function o(e, t) {
+function s(e, t) {
 	let n = e.replace(/^v/u, ""), r = t.replace(/^v/u, ""), i = Math.min(n.length, r.length);
 	return i < 7 ? !1 : n.slice(0, Math.max(0, i)).toLowerCase() === r.slice(0, Math.max(0, i)).toLowerCase();
 }
-function s(e) {
+function c(e) {
 	if (!e) return !1;
 	let t = e.replace(/^v/u, "");
 	return /^[0-9a-f]{7,40}$/iu.test(t);
 }
-function c(e) {
-	return e ? s(e) ? "sha" : t(e) ? "tag" : "unknown" : "unknown";
+function l(t) {
+	return t ? c(t) ? "sha" : e(t) ? "tag" : "unknown" : "unknown";
 }
-function l(e) {
+function u(e) {
 	return e instanceof Error && e.name === "GitHubRateLimitError";
 }
-export { i as checkUpdates };
+export { a as checkUpdates };

package/dist/core/ast/update/apply-updates.js

@@ -15,7 +15,7 @@ async function n(n) {
 			function i(e) {
 				return e.replaceAll(/[$()*+\-./?[\\\]^{|}]/gu, String.raw`\$&`);
 			}
-			let o = i(e.action.name), s = e.currentVersion ? i(e.currentVersion) : "";
+			let o = i(e.action.name), s = e.currentVersion ? i(e.currentVersion) : "", c = s ? String.raw`(?=(?:['"]|[ \t\]}{,#]|$))` : "";
 			if (o.includes("\n") || o.includes("\r")) {
 				console.error(`Invalid action name: ${e.action.name}`);
 				continue;
@@ -32,8 +32,8 @@ async function n(n) {
 				console.error(`Invalid SHA format: ${t}`);
 				continue;
 			}
-			let c = String.raw`['"]?\buses\b['"]?\s*:\s*`, l = String.raw`(?:^[^\S\n]*(?:-[^\S\n]*)?|[{\[,][^\S\n]*)` + c, u = new RegExp(String.raw`(?<prefix>${l})` + String.raw`(?<quote>['"]?)` + String.raw`(?<name>${o})@${s}` + String.raw`\k<quote>` + String.raw`(?<after>[ \t\]}{,]*)` + String.raw`(?<comment>[^\S\r\n]*#[^\r\n]*)?`, "gm");
-			a = a.replace(u, (i, ...a) => {
+			let l = String.raw`['"]?\buses\b['"]?\s*:\s*`, u = String.raw`(?:^[^\S\n]*(?:-[^\S\n]*)?|[{\[,][^\S\n]*)` + l, d = new RegExp(String.raw`(?<prefix>${u})` + String.raw`(?<quote>['"]?)` + String.raw`(?<name>${o})@${s}${c}` + String.raw`\k<quote>` + String.raw`(?<after>[ \t\]}{,]*)` + String.raw`(?<comment>[^\S\r\n]*#[^\r\n]*)?`, "gm");
+			a = a.replace(d, (i, ...a) => {
 				let o = a.at(-3), c = a.at(-2), l = a.at(-1), u = c.indexOf("\n", o + i.length), d = (u === -1 ? c.slice(o + i.length) : c.slice(o + i.length, u)).trim().length > 0, f = l.after.endsWith(" ") ? "" : " ", p = "";
 				if (n === "sha") p = d && !l.comment && s !== "" ? "" : `${f}# ${e.latestVersion}`;
 				else if (l.comment && !r(l.comment)) {

package/dist/core/updates/resolve-target-reference.js

@@ -1,24 +1,35 @@
-function e(e, t) {
-	return e.hasUpdate ? t === "sha" || e.currentRefType === "sha" ? e.latestSha ? {
-		...e,
-		targetRef: e.latestSha,
-		targetRefStyle: "sha"
-	} : {
-		...e,
+import { preserveTagFormat as e } from "../versions/preserve-tag-format.js";
+function t(t, n) {
+	if (!t.hasUpdate) return {
+		...t,
 		targetRefStyle: null,
 		targetRef: null
-	} : e.currentRefType === "tag" && e.latestVersion ? {
-		...e,
-		targetRef: e.latestVersion,
-		targetRefStyle: "tag"
+	};
+	if (n === "sha" || t.currentRefType === "sha") return t.latestSha ? {
+		...t,
+		targetRef: t.latestSha,
+		targetRefStyle: "sha"
 	} : {
-		...e,
+		...t,
 		targetRefStyle: null,
 		targetRef: null
-	} : {
-		...e,
+	};
+	if (t.currentRefType === "tag" && t.latestVersion) {
+		let n = e(t.currentVersion, t.latestVersion);
+		return n ? {
+			...t,
+			targetRef: n,
+			targetRefStyle: "tag"
+		} : {
+			...t,
+			targetRefStyle: null,
+			targetRef: null
+		};
+	}
+	return {
+		...t,
 		targetRefStyle: null,
 		targetRef: null
 	};
 }
-export { e as resolveTargetReference };
+export { t as resolveTargetReference };

package/dist/core/versions/find-compatible-tag.js

@@ -1,14 +1,14 @@
-import { normalizeVersion as e } from "./normalize-version.js";
-import { isSemverLike as t } from "./is-semver-like.js";
+import { isSemverLike as e } from "./is-semver-like.js";
+import { normalizeVersion as t } from "./normalize-version.js";
 import n from "semver";
 function r(r, a, o) {
-	if (!a || !t(a) || r.length === 0) return null;
-	let s = n.valid(e(a));
+	if (!a || !e(a) || r.length === 0) return null;
+	let s = n.valid(t(a));
 	if (!s) return null;
 	let c = n.major(s), l = n.minor(s), u = [];
 	for (let i of r) {
-		if (!t(i.tag)) continue;
-		let r = n.valid(e(i.tag));
+		if (!e(i.tag)) continue;
+		let r = n.valid(t(i.tag));
 		r && n.gt(r, s) && n.major(r) === c && (o === "patch" && n.minor(r) !== l || u.push({
 			tag: i,
 			parsed: r

package/dist/core/versions/preserve-tag-format.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Preserve the semver granularity of the current tag when projecting a newer
+ * tag reference.
+ *
+ * Examples:
+ *
+ * - `v6` + `v7.0.2` -> `v7`
+ * - `v6.1` + `v6.2.3` -> `v6.2`
+ * - `v6.1.4` + `v6.2.3` -> `v6.2.3`.
+ *
+ * Returns null when the target tag cannot be preserved safely.
+ *
+ * @param currentVersion - Current tag reference found in the workflow.
+ * @param latestVersion - Latest resolved tag reference.
+ * @returns Preserved tag reference or null when preservation is unsafe.
+ */
+export declare function preserveTagFormat(currentVersion: undefined | string | null, latestVersion: undefined | string | null): string | null;

package/dist/core/versions/preserve-tag-format.js

@@ -0,0 +1,11 @@
+import { isSemverLike as e } from "./is-semver-like.js";
+function t(t, n) {
+	if (!t || !n) return null;
+	let r = t.trim(), i = n.trim();
+	if (!e(r) || !e(i)) return null;
+	let a = r.startsWith("v");
+	if (a !== i.startsWith("v")) return null;
+	let o = r.replace(/^v/u, "").split("."), s = i.replace(/^v/u, "").split(".");
+	return s.length < o.length ? null : `${a ? "v" : ""}${s.slice(0, o.length).join(".")}`;
+}
+export { t as preserveTagFormat };

package/dist/package.js

@@ -1,2 +1,2 @@
-var e = "1.14.1";
+var e = "1.14.3";
 export { e as version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "actions-up",
-  "version": "1.14.1",
+  "version": "1.14.3",
   "description": "Interactive CLI tool to update GitHub Actions with SHA pinning or preserved refs",
   "keywords": [
     "github-actions",
@@ -36,14 +36,13 @@
     "./dist"
   ],
   "dependencies": {
-    "cac": "^7.0.0",
     "enquirer": "^2.4.1",
     "nanospinner": "^1.2.2",
     "picocolors": "^1.1.1",
-    "semver": "^7.7.4",
-    "yaml": "^2.8.3"
+    "semver": "^7.8.4",
+    "yaml": "^2.9.0"
   },
   "engines": {
-    "node": "^18.0.0 || >=20.0.0"
+    "node": "^18.3.0 || >=20.0.0"
   }
 }

package/readme.md

@@ -3,9 +3,8 @@
 <img
   src="https://raw.githubusercontent.com/azat-io/actions-up/main/assets/logo.svg"
   alt="Actions Up logo"
-  width="160"
-  height="160"
   align="right"
+  width="160"
 />
 
 [![Version](https://img.shields.io/npm/v/actions-up.svg?color=fff&labelColor=4493f8)](https://npmjs.com/package/actions-up)
@@ -102,7 +101,8 @@ Per-project
 npm install --save-dev actions-up
 ```
 
-Alternatively, you can install Actions Up with [Homebrew](https://brew.sh)
+Alternatively, you can install Actions Up with
+[Homebrew](https://formulae.brew.sh/formula/actions-up)
 
 ```bash
 brew install actions-up
@@ -214,9 +214,11 @@ Use `--style preserve` to keep the current reference style:
 npx actions-up --style preserve
 ```
 
-`preserve` keeps tag references on tags and SHA references on SHAs. For example,
-`actions/checkout@v5` updates to `actions/checkout@v6.0.2`, while a SHA-pinned
-action continues updating to the latest resolved SHA.
+`preserve` keeps tag references on tags and SHA references on SHAs. Tag refs
+also keep their granularity, so `actions/checkout@v5` updates to
+`actions/checkout@v6`, while `actions/checkout@v5.0` updates to
+`actions/checkout@v6.0`. A SHA-pinned action continues updating to the latest
+resolved SHA.
 
 ## GitHub Actions Integration