s4na/action-age-check
Fail CI when a workflow uses a GitHub Action that was released too recently (supply-chain cooldown gate).
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| min-age | Minimum age of each used action. e.g. 1d, 2d, 7d, 1w, 2w. A bare number is treated as days. | no | 1w |
| paths | Newline-separated files/directories to scan. Missing paths or zero collected YAML files fail the job. | no | .github/workflows |
| allow | Newline-separated allowlist (owner/repo or owner/repo@ref) to exclude from the age check. | no | "" |
| fail-level | "error" fails the job; "warning" only annotates. | no | error |
| include-local | Reserved (not yet implemented). Local (./) and docker:// uses are always skipped regardless of this flag. | no | false |
| token | Token for GitHub API calls (rate limit / private resolution). | no | ${{ github.token }} |
Outputs
| name | description |
|---|---|
| checked-count | Number of remote action references checked. |
| violation-count | Number of references that failed: younger than min-age, unpinned, branch pin, ref not found, or API error. |
| violations | JSON array of violation objects. |