dusktreader/chill-out-action

Audit your lockfile for packages that are too fresh to trust.

View on GitHub

Trust Signals

Scorecard Score
not yet scored
Maintenance Recency
Stale
License
None
namedescriptionrequireddefault
commandThe chill-out command to run. One of: 'check': read-only audit, fails if violations found 'fix': auto-pin violating packages to safe versions, commit to a new branch, and open a pull request against base-branch nocheck
versionThe version of chill-out to use. Accepts any version specifier accepted by uv (e.g. '0.1.0', '>=0.1.0', or 'latest'). Defaults to 'latest'. nolatest
rootPath to the project root (the directory containing the lockfile). Defaults to the repository root. no.
ecosystemForce a specific ecosystem ('pypi' or 'npm'). Auto-detected when omitted. no""
fastSkip the safe-version lookup when running 'check'. Faster, but no fix suggestions are shown. Has no effect when command is 'fix'. nofalse
ignoreNewline-separated list of package names to skip during the cooldown check. Names are matched against the lockfile after PEP 503 normalization (lowercase, hyphens replacing underscores). Merged with any 'ignore' list already present in the project's chill-out config file. no""
fix-styleOverride the configured fix style for a 'fix' run. One of 'exact' or 'compatible'. Has no effect when command is 'check'. no""
recheckAfter applying fixes, re-run the check to confirm they took. Only relevant when command is 'fix'. Defaults to 'true'. notrue
cleanupBefore computing fresh fixes, remove any pins chill-out wrote on previous runs whose underlying release has now cleared cooldown. Only relevant when command is 'fix'. Defaults to 'true'. notrue
base-branchThe branch that the fix PR will target. Defaults to the repository's default branch. Only relevant when command is 'fix'. no""
commit-messageThe commit message and PR title used when command is 'fix'. Defaults to 'fix: pin cooldown violations [chill-out]'. nofix: pin cooldown violations [chill-out]
github-tokenGitHub token used to push the fix branch and open the pull request. Pass secrets.GITHUB_TOKEN or a PAT with contents:write and pull-requests:write scopes. Only relevant when command is 'fix'. no${{ github.token }}
uv-versionThe version of uv to install (e.g. '0.5.0'). Passed to astral-sh/setup-uv as the 'version' input. Defaults to 'latest'. nolatest
namedescription
exit-codeThe exit code returned by chill-out. 0 means all clear; non-zero means violations were found or the command failed.
pr-urlURL of the pull request opened or updated by a 'fix' run. Empty when command is 'check' or when no violations were found.