Feature: freshness indicator + one-click bump for outdated uses: action versions
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 45/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- github-actions, typescript, vscode
- Domain
- ci-cd, developer-experience, devtools
Research direction
Start by tracing the extension's existing uses: resolution and authenticated action-metadata calls, including the related work in #592 and #593. Define how freshness results, CodeLens, Quick Fix behavior, 24-hour caching, and the github-actions.versionCheck settings fit that pipeline. Done means outdated refs are surfaced inline and can be updated while preserving the configured pin style.
Written by the indexing model from the issue text.
Description
Summary
The extension already resolves uses: owner/repo@ref for validation. It does not surface whether the pinned ref is the latest.
Effect: workflows quietly drift onto EOL action majors (e.g. actions/checkout@v3 after v4 is default, actions/upload-artifact@v3 after the v3 sunset). Users only notice on a deprecation warning in a run log, weeks later.
Proposal
For each uses: line:
- On workflow open, resolve the pinned ref against the action's releases (already an authenticated call the extension can make).
- If a newer major/minor exists, render a subtle CodeLens above the line:
v3 -> v4 available (published 3 months ago). - Clicking the CodeLens offers a Quick Fix: rewrite
@v3to@v4(or@<sha> # v4.1.7if the current pin is a SHA, preserving the pin style). - Results cached per-action for 24h to avoid API-limit churn. Setting:
github-actions.versionCheck.enabled(default: on) +github-actions.versionCheck.pinStyle(tag|sha|preserve, defaultpreserve).
Why this belongs in the extension
Dependabot handles it eventually, but only after a PR round-trip. Renovate/Dependabot are async, this is inline. Same latency benefit as npm-outdated inline hints in the JS ecosystem.
Non-goals
- Not a security scanner (that is dependabot /
gh actions-secureterritory). - Not automated PR opening.
Related
- #592 (autocomplete for action inputs) - same "we already have action metadata loaded" muscle
- #593 (commit-pinned unresolved) - same resolution pipeline
- Dominant language
- TypeScript
- Stars
- 661
- Forks
- 214
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/vscode-github-actions
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
github/vscode-github-actions#627 · 1 reaction ·
-
Difficulty 5/5 Over a week Newbie friendliness 20/100
github/vscode-github-actions#630 · 1 reaction ·
-
long work Open
Difficulty 4/5 3-5 days Newbie friendliness 25/100
github/vscode-github-actions#628 ·
-
bug
Difficulty 3/5 1-2 days Newbie friendliness 55/100
github/vscode-github-actions#625 ·
-
bug
Difficulty 3/5 1-2 days Newbie friendliness 64/100
github/vscode-github-actions#621 · 3 comments ·
All issues in github/vscode-github-actions
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
bcgov/bc-wallet-mobile#4761 · 1 comment ·
-
external-issue to-triage
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
area-deployment area-integrations triage:bot-seen
Difficulty 2/5 Half a day Newbie friendliness 86/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
refactor
Difficulty 2/5 1-3 hours Newbie friendliness 84/100