g-research-packages/check-and-republish-packages
Scans other repos, potentially in other orgs, for workflows which ran the request-republish-package step on permitted branches. Downloads their Artifacts, checks that hashes are as expected and republishes them as GitHub packages.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stalelast commit Nov 22, 2023
- License
- None
- Runtime
- Deprecated runtime
Pinned Snippet
uses: g-research-packages/check-and-republish-packages@9ac80a1eab8213cb626cc73d61006071425fdbef # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| source-owner | The GitHub owner (organisation or individual) of the repos to scan. | yes | — |
| source-repo-workflow-branches | A comma-separated list of repo/workflow/branch combinations to search for artifact-producing workflow runs. | yes | — |
| source-token | A GitHub auth token which has access to read workflow information, including logs and artifacts, from the source owner and repo(s). | yes | — |
| package-push-user | (obsolete) A GitHub user which has access to list and upload packages to the repo where this action is running. | no | svc-gh-packagemanager |
| package-push-token | A GitHub auth token which has access to list and upload packages and releases to the repo where this action is running. | yes | — |
| publish-as-release | If true, publish build artifact as a Release in the repo where this action is running, rather than as a Package on the Org. Name your release artifact <name of release>_<releasetag>.tar.gz (only .tar.gz is supported) | no | — |
Outputs
no outputs