Skip to content
pinprick

update

Check SHA-pinned actions for newer releases and optionally update them.

Workflows are discovered under .github/workflows/, .forgejo/workflows/, and .gitea/workflows/ (whichever exist are all scanned). Forgejo and Gitea use GitHub-compatible workflow syntax. Release checks go through the github.com API, so actions hosted on a Forgejo or Gitea instance cannot be checked; only github.com-hosted actions (the common case).

Terminal window
pinprick update                       # dry-run (show available updates)
pinprick update --write               # write updates to files
pinprick update --only actions/       # only check actions in the `actions/` org
pinprick update --only actions/checkout
pinprick update /path/to/repo

Behavior

Section titled “Behavior”
  • Checks SHA-pinned actions. A version tag comment (for example @sha # v4.1.0) avoids a lookup; for a bare SHA, pinprick asks GitHub which version tag points at it
  • Queries the GitHub Releases API for the latest non-draft, non-prerelease release
  • Compares version numbers numerically — suggests the latest release regardless of major version
  • Dry-run by default — shows what would change without writing files
  • Each update is printed with a link to the release page for easy changelog review
  • Exit code 1 when updates are available (useful in CI)
  • Exit code 2 when any action could not be checked. --write stages every result and changes no files when an API lookup fails. A pinned SHA with no version tag is reported as skipped but does not block independently verified updates
  • Flow-style mappings, escaped YAML keys, and multiline uses: values are unsupported: they exit 2 and block all writes rather than being mistaken for an up-to-date workflow

Filtering with --only

Section titled “Filtering with --only”

--only <pattern> restricts the scan to actions whose owner/repo contains the pattern as a substring. Useful in CI pipelines that bump one action at a time, or to scope an update to a single org:

Terminal window
pinprick update --only actions/checkout    # exactly this action
pinprick update --only actions/            # all actions/* repos
pinprick update --only aws                 # any repo with "aws" in owner/repo

Matching is case-sensitive. Matching is against owner/repo only — subpaths are not considered.

Example

Section titled “Example”
$ pinprick update
.github/workflows/ci.yml
  actions/checkout v4.1.0 -> v7.0.0
    https://github.com/actions/checkout/releases/tag/v7.0.0
  actions/setup-node v4.0.0 -> v6.4.0
    https://github.com/actions/setup-node/releases/tag/v6.4.0


2 updates available. Run with --write to apply.