actions-up 1.7.0 → 1.9.0

package/dist/cli/index.js

@@ -60,7 +60,7 @@ function run() {
 				}
 				console.info(pc.yellow(`\n🔄 Updating ${e.length} actions...\n`)), await applyUpdates(e), console.info(pc.green("\n✓ Updates applied successfully!"));
 			} else {
-				let o = await promptUpdateSelection(y, { showAge: c.minAge > 0 });
+				let o = await promptUpdateSelection(x, { showAge: c.minAge > 0 });
 				if (!o || o.length === 0) {
 					console.info(pc.gray("\nNo updates applied"));
 					return;

package/dist/core/ast/update/apply-updates.js

@@ -27,8 +27,11 @@ async function applyUpdates(n) {
 				console.error(`Invalid SHA format: ${e.latestSha}`);
 				continue;
 			}
-			let a = r ? String.raw`(?=[^\S\r\n]|$|#)` : "", o = new RegExp(String.raw`(^\s*-?\s*uses:\s*)(['"]?)(${n})@${r}\2${a}([^\S\r\n]*#[^\r\n]*)?`, "gm"), s = `$1$2$3@${e.latestSha}$2 # ${e.latestVersion}`;
-			i = i.replace(o, s);
+			let a = String.raw`['"]?\buses\b['"]?\s*:\s*`, o = String.raw`(?:^[^\S\n]*(?:-[^\S\n]*)?|[{\[,][^\S\n]*)` + a, s = new RegExp(String.raw`(?<prefix>${o})` + String.raw`(?<quote>['"]?)` + String.raw`(?<name>${n})@${r}` + String.raw`\k<quote>` + String.raw`(?<after>[ \t\]}{,]*)` + String.raw`(?<comment>[^\S\r\n]*#[^\r\n]*)?`, "gm");
+			i = i.replace(s, (t, ...n) => {
+				let i = n.at(-3), a = n.at(-2), o = n.at(-1), s = a.indexOf("\n", i + t.length), c = (s === -1 ? a.slice(i + t.length) : a.slice(i + t.length, s)).trim().length > 0, l = o.after.endsWith(" ") ? "" : " ", u = c && !o.comment && r !== "" ? "" : `${l}# ${e.latestVersion}`;
+				return `${`${o.prefix}${o.quote}${o.name}`}@${`${e.latestSha}${o.quote}${o.after}${u}`}`;
+			});
 		}
 		await writeFile(n, i, "utf8");
 	});

package/dist/core/scan-github-actions.js

@@ -19,11 +19,19 @@ async function scanGitHubActions(d = process.cwd(), m = GITHUB_DIRECTORY) {
 	function y(e) {
 		return e.includes("..") || e.includes("/") || e.includes("\\") ? (console.warn(`Skipping invalid name: ${e}`), !1) : !0;
 	}
-	let b = join(v, WORKFLOWS_DIRECTORY);
+	async function b(e) {
+		try {
+			let o = await stat(e);
+			return typeof o.isFile == "function" ? o.isFile() : !1;
+		} catch {
+			return !1;
+		}
+	}
+	let x = join(v, WORKFLOWS_DIRECTORY);
 	try {
-		if ((await stat(b)).isDirectory()) {
-			let e = (await readdir(b)).filter((e) => y(e) ? isYamlFile(e) : !1).map(async (e) => {
-				let o = join(b, e);
+		if ((await stat(x)).isDirectory()) {
+			let e = (await readdir(x)).filter((e) => y(e) ? isYamlFile(e) : !1).map(async (e) => {
+				let o = join(x, e);
 				try {
 					let l = await scanWorkflowFile(o);
 					return {
@@ -42,12 +50,29 @@ async function scanGitHubActions(d = process.cwd(), m = GITHUB_DIRECTORY) {
 			for (let e of o) e.success && e.path && (e.actions.length > 0 ? (h.workflows.set(e.path, e.actions), h.actions.push(...e.actions)) : h.workflows.set(e.path, []));
 		}
 	} catch {}
-	let x = join(v, ACTIONS_DIRECTORY);
 	try {
-		if ((await stat(x)).isDirectory()) {
-			let o = (await readdir(x)).map(async (o) => {
+		let e = join(g, "action.yml"), o = join(g, "action.yaml"), s = null, c = [];
+		if (await b(e)) try {
+			c = await scanActionFile(e), s = e;
+		} catch {
+			s = null;
+		}
+		if (!s && await b(o)) try {
+			c = await scanActionFile(o), s = o;
+		} catch {
+			s = null;
+		}
+		if (s) {
+			let e = relative(g, s);
+			h.compositeActions.set(e, e), c.length > 0 && h.actions.push(...c);
+		}
+	} catch {}
+	let S = join(v, ACTIONS_DIRECTORY);
+	try {
+		if ((await stat(S)).isDirectory()) {
+			let o = (await readdir(S)).map(async (o) => {
 				if (!y(o)) return null;
-				let s = join(x, o);
+				let s = join(S, o);
 				try {
 					if (!(await stat(s)).isDirectory()) return null;
 					let c = join(s, "action.yml"), u = [];

package/dist/package.js

@@ -1,2 +1,2 @@
-const version = "1.7.0";
+const version = "1.9.0";
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "actions-up",
-  "version": "1.7.0",
+  "version": "1.9.0",
   "description": "Interactive CLI tool to update GitHub Actions to latest versions with SHA pinning",
   "keywords": [
     "github-actions",

package/readme.md

@@ -18,7 +18,7 @@ Interactively upgrade and pin actions to exact commit SHAs for secure, reproduci
 
 ## Features
 
-- **Auto-discovery**: Scans all workflows (`.github/workflows/*.yml`) and composite actions (`.github/actions/*/action.yml`)
+- **Auto-discovery**: Scans all workflows (`.github/workflows/*.yml`) and composite actions (`.github/actions/*/action.yml` and root `action.yml`/`action.yaml`)
 - **Reusable Workflows**: Detects and updates reusable workflow calls at the job level
 - **SHA pinning**: Updates actions to use commit SHA instead of tags for better security
 - **Batch Updates**: Update multiple actions at once
@@ -100,7 +100,7 @@ npx actions-up
 
 This will:
 
-1. Scan all `.github/workflows/*.yml` and `.github/actions/*/action.yml` files
+1. Scan all `.github/workflows/*.yml` and `.github/actions/*/action.yml` files, plus root `action.yml`/`action.yaml`
 2. Check for available updates
 3. Show an interactive list to select updates
 4. Apply selected updates with SHA pinning