github-actions-updaterncu for GitHub Actions.

Scan .github/workflows for outdated references — and apply the bumps with one command.

Every ref style

Tag refs (`@v4`), exact tags (`@v4.1.1`), SHA-pinned with version comments, branch refs, and `docker://` images — all handled.

Colored, glyph-bordered table by default. `--json` for CI. Interactive multi-select with `-i`.

`--write` replaces version strings in place. Comments, formatting, and whitespace stay exactly as you wrote them.

`GITHUB_TOKEN` → `gh auth token` → anonymous, in that order. No flags needed in most setups.

142+ unit and integration tests. Strict TypeScript. Zero shell-injection surface.

This repo runs `ghau` against its own workflows every Monday. The tool maintains itself.

bash

# global
npm install -g github-actions-updater

# or with pnpm
pnpm add -g github-actions-updater

# or ephemeral
npx github-actions-updater

bash

# Scan and report
ghau

# Apply every available update
ghau -u

# Pick what to apply
ghau -i

# CI-friendly machine output
ghau --json