model-eol 0.2.3 → 0.2.4

package/README.md

@@ -8,17 +8,18 @@
 ![license](https://img.shields.io/badge/license-MIT-blue)
 
 **A machine-readable deprecation feed format for AI models, plus the reference
-tooling that turns it into a Dependabot for models.** v0.2.2.
+tooling that turns it into a Dependabot for models.** v0.2.3.
 
 ![model-eol demo: retired models, distributor clocks, worst-case date](docs/img/demo.gif)
 
 ## The problem
 
-On July 23, 2026, OpenAI shut down 18 models on schedule. Teams that pinned dated
-snapshots - the provider's own recommended practice - got production 404s, because a
-model ID is the one dependency your toolchain can't see. When an npm package is
-deprecated, the warning prints at install, Dependabot opens the PR, the advisory
-fails CI. A model's retirement date lives in an HTML docs page and an email.
+On July 23, 2026, OpenAI shut down 15 model snapshots on schedule. One of my
+tuned research workflows returned a model-not-found error that morning even though
+the retirement had been documented for months. A model ID is the one dependency
+my toolchain could not see. When an npm package is deprecated, the warning prints
+at install, Dependabot opens the PR, and an advisory can fail CI. A model's
+retirement date usually lives in an HTML docs page and an email.
 
 Ordinary software solved this layer: endoflife.date for EOL data, OSV for
 vulnerability feeds. This is the model version - a shared schema first, tooling
@@ -100,6 +101,31 @@ PRs to trigger checks), and provider API keys enter the picture in exactly two
 optional places: your own eval hook command, and the feed-refresh models-endpoint
 coverage.
 
+## Use it as a GitHub Action
+
+The same gate as a composite action - no npm install, feeds bundled, pinned to
+the `v0` line:
+
+```yaml
+- uses: actions/checkout@v4
+  with:
+    fetch-depth: 0 # --changed needs history to diff against the base ref
+- uses: thossullivan/model-eol@v0
+  with:
+    command: check
+    changed: origin/${{ github.base_ref }}
+    days: 90
+    scope: direct
+```
+
+That is the PR gate: fail only when *this* change adds a model that is retired
+or retiring within the threshold. Add `via: aws-bedrock` (or `azure-ai-foundry`)
+to judge by a distributor's clock. The copy-paste version with both gates - PR
+diff plus a weekly full-repository check - is
+[`examples/workflows/model-eol.yml`](examples/workflows/model-eol.yml); the
+same inputs drive `inventory` and `schedule` if CI should export an ML-BOM or a
+retirement calendar instead.
+
 ## Same weights, different clocks
 
 The same model retires on different dates per channel, and a checker that ignores
@@ -111,13 +137,13 @@ channel you actually call, and the bedrock distributor fetcher keeps the clocks
 current from AWS's own lifecycle page. Treat a distributor's later date as runway
 for the same migration, not as a destination.
 
-## Policy floors - a forward guarantee from absence
+## Policy floors - a planning floor from absence
 
 A feed entry with no `announced` and no `shutdown` is an affirmative "nothing
 scheduled as of `generated`" - something scraping HTML can never say. Publishers
-with a stated minimum notice period (Anthropic commits to >=60 days) carry a
-`policy` floor, so the schedule can say `guaranteed until <date> per anthropic
-stated policy`. Stated policy, not a contract - the wording says so. OpenAI
+with a stated minimum notice period (Anthropic states >=60 days) carry a
+`policy` floor, so the schedule can calculate a no-earlier-than planning date
+from the feed refresh. Stated policy, not a contract. OpenAI
 publishes no formal floor, so its feed makes no forward claim.
 
 ## Direct-first inventory
@@ -178,6 +204,14 @@ their keep: they caught the hand-compiled feeds drifting from Anthropic's
 recommendations within one week, and corrected a hand-compiled Bedrock date that
 was three months wrong.
 
+The refresh also travels in the other direction. On August 3, Google removed the
+previously listed October 16 earliest shutdown dates for the Gemini 2.5 Pro,
+Flash, and Flash-Lite GA models. The pipeline opened
+[a PR with the semantic retraction](https://github.com/thossullivan/model-eol/pull/60),
+and merging it published v0.2.3 so downstream checks stopped warning from dates
+Google no longer listed. A lifecycle tracker has to retract stale alarms as well
+as add new ones.
+
 ## The actual ask
 
 The endgame is not "another checker"; it's the format. Providers already publish

package/check.mjs

@@ -34,6 +34,7 @@ import {
 } from './lib/reports.mjs'
 import { addedLinesForTargets, filterFindingsToChanged, incompleteScanNotes, scanTargets } from './lib/scanner.mjs'
 
+const main = () => {
 const COMMANDS = new Set(['check', 'inventory', 'schedule', 'alert', 'plan', 'apply', 'help'])
 const args = process.argv.slice(2)
 
@@ -62,7 +63,7 @@ try {
   })
 } catch (error) {
   console.error(error.message)
-  process.exit(2)
+  return 2
 }
 
 const { values, positionals } = parsed
@@ -107,43 +108,49 @@ Commands:
 Scopes:
   all        Check every tracked model ID found. This preserves the original behavior.
   direct     Check direct API and generic model references; leave cloud/gateway refs in inventory.
+
+Exit codes:
+  0  Clean, or report generated successfully.
+  1  Findings, alert errors, or refused apply items.
+  2  Usage, feed, scan, or plan errors.
+  3  Output stream failure other than EPIPE.
 `)
-  process.exit(0)
+  return 0
 }
 
 if (command === 'apply') {
   if (!PLAN_FILE || positionals.length) {
     console.error('apply requires --plan plan.json and accepts no target paths')
-    process.exit(2)
+    return 2
   }
   try {
     const result = applyPlan({ planPath: PLAN_FILE, dryRun: DRY_RUN, rootDir: process.cwd() })
-    process.exit(result.failed ? 1 : 0)
+    return result.failed ? 1 : 0
   } catch (e) {
     console.error(`failed to apply plan ${PLAN_FILE}: ${e.message}`)
-    process.exit(2)
+    return 2
   }
 }
 
 if (!Number.isFinite(DAYS) || !Number.isInteger(DAYS) || DAYS < 0) {
   console.error('--days must be a finite non-negative integer')
-  process.exit(2)
+  return 2
 }
 if (!['all', 'direct'].includes(SCOPE)) {
   console.error('--scope must be all or direct')
-  process.exit(2)
+  return 2
 }
 if (CHANGED_BASE !== null && command !== 'check') {
   console.error('--changed is only supported by the check command')
-  process.exit(2)
+  return 2
 }
 if (command === 'alert' && FORMAT !== null && !['github', 'markdown', 'badge', 'json'].includes(FORMAT)) {
   console.error('--format must be github, markdown, badge, or json for alert')
-  process.exit(2)
+  return 2
 }
 if (command === 'inventory' && FORMAT !== null && !['json', 'cyclonedx', 'text'].includes(FORMAT)) {
   console.error('--format must be json, cyclonedx, or text for inventory')
-  process.exit(2)
+  return 2
 }
 
 let feedData
@@ -151,11 +158,11 @@ try {
   feedData = loadFeeds(FEEDS_DIR)
 } catch (e) {
   console.error(`failed to load feeds from ${FEEDS_DIR}: ${e.message}`)
-  process.exit(2)
+  return 2
 }
 if (feedData.entries.size === 0) {
   console.error(`no feed entries loaded from ${FEEDS_DIR}`)
-  process.exit(2)
+  return 2
 }
 
 let scan
@@ -168,7 +175,7 @@ try {
   })
 } catch (e) {
   console.error(`scan failed: ${e.message}`)
-  process.exit(2)
+  return 2
 }
 
 const incompleteNotes = incompleteScanNotes(scan.notes)
@@ -179,23 +186,22 @@ if (incompleteNotes.length && (command === 'check' || command === 'plan')) {
     const location = note.file ? ` (${note.file})` : ''
     console.error(`  ${note.reason}${location}${note.message ? `: ${note.message}` : ''}`)
   }
-  if (!ALLOW_INCOMPLETE) process.exit(2)
+  if (!ALLOW_INCOMPLETE) return 2
 }
 
 const findings = scan.modelRefs.map(ref => findingFromRef(ref, { days: DAYS, via: VIA }))
 const checkFindings = SCOPE === 'direct'
   ? findings.filter(f => f.usage === 'direct-api' || f.usage === 'model-reference')
   : findings
-const changedFindings = CHANGED_BASE === null
-  ? checkFindings
-  : (() => {
-      try {
-        return filterFindingsToChanged(checkFindings, addedLinesForTargets(targets, CHANGED_BASE))
-      } catch (e) {
-        console.error(`--changed failed: ${e.message}`)
-        process.exit(2)
-      }
-    })()
+let changedFindings = checkFindings
+if (CHANGED_BASE !== null) {
+  try {
+    changedFindings = filterFindingsToChanged(checkFindings, addedLinesForTargets(targets, CHANGED_BASE))
+  } catch (e) {
+    console.error(`--changed failed: ${e.message}`)
+    return 2
+  }
+}
 const bad = changedFindings.filter(isBad)
 const inventory = () => buildInventory({ scan, findings, days: DAYS, via: VIA, scope: SCOPE, targets })
 const schedule = () => buildSchedule(inventory())
@@ -210,7 +216,7 @@ if (command === 'plan') {
     via: VIA,
     scope: SCOPE,
   }), null, 2))
-  process.exit(0)
+  return 0
 }
 
 if (command === 'check') {
@@ -219,7 +225,7 @@ if (command === 'check') {
   } else {
     console.log(formatCheck({ findings: changedFindings, bad, scannedFiles: scan.files.length, days: DAYS, scope: SCOPE }))
   }
-  process.exit(bad.length ? 1 : 0)
+  return bad.length ? 1 : 0
 }
 
 if (command === 'inventory') {
@@ -232,7 +238,7 @@ if (command === 'inventory') {
   } else {
     console.log(formatInventory(inv, DAYS))
   }
-  process.exit(0)
+  return 0
 }
 
 if (command === 'schedule') {
@@ -242,7 +248,7 @@ if (command === 'schedule') {
   } else {
     console.log(formatSchedule(sched, DAYS))
   }
-  process.exit(0)
+  return 0
 }
 
 if (command === 'alert') {
@@ -256,8 +262,46 @@ if (command === 'alert') {
   } else {
     console.log(formatAlertGithub(payload, DAYS))
   }
-  process.exit(payload.errors.length ? 1 : 0)
+  return payload.errors.length ? 1 : 0
 }
 
 console.error(`unknown command: ${command}`)
-process.exit(2)
+return 2
+}
+
+const writeAndCapture = (stream, chunk) => new Promise(resolve => {
+  let error = null
+  let settling = false
+  const settle = nextError => {
+    if (nextError && !error) error = nextError
+    if (settling) return
+    settling = true
+    setImmediate(() => {
+      stream.off('error', onError)
+      resolve(error)
+    })
+  }
+  const onError = nextError => settle(nextError)
+  stream.on('error', onError)
+  try {
+    stream.write(chunk, settle)
+  } catch (writeError) {
+    settle(writeError)
+  }
+})
+const drainStream = stream => writeAndCapture(stream, '')
+
+const exitCode = main()
+const [stdoutError, stderrError] = await Promise.all([
+  drainStream(process.stdout),
+  drainStream(process.stderr),
+])
+const outputError = [stdoutError, stderrError].find(error => error && error.code !== 'EPIPE')
+let finalExitCode = exitCode
+if (exitCode === 0 && outputError) {
+  finalExitCode = 3
+  const diagnosticStream = stderrError ? (stdoutError ? null : process.stdout) : process.stderr
+  const detail = String(outputError.code ?? outputError.message ?? 'unknown error').replace(/[\r\n]+/g, ' ')
+  if (diagnosticStream) await writeAndCapture(diagnosticStream, `model-eol: output failed: ${detail}\n`)
+}
+process.exit(finalExitCode)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "model-eol",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "A machine-readable deprecation feed format for AI models, plus a zero-dependency checker and inventory CLI.",
   "type": "module",
   "bin": {