bump-github-actions

A fast CLI tool that automatically bumps GitHub Actions in your workflow files to their latest major versions.

Scans every .yml / .yaml file in .github/workflows, queries the GitHub API for the newest tags, and rewrites pinned versions in place.

Install

bun add -g @jadujoel/bump-github-actions

Or run directly without installing:

bunx @jadujoel/bump-github-actions

Usage

Run from the root of any repository that contains a .github/workflows directory:

bump-github-actions

Example output

Found 5 unique action(s) across 3 workflow file(s).

Checking actions/checkout@v3 ... update available: v3 -> v4
Checking actions/setup-node@v4 ... up to date (v4).
Checking softprops/action-gh-release@v1 ... update available: v1 -> v2

Applying 2 update(s)...

  Updated .github/workflows/ci.yml
  Updated .github/workflows/release.yml

Done.

Both short (@v3) and full semver (@v3.1.0) references are detected and replaced.

Authentication

Unauthenticated requests to the GitHub API are rate-limited to 60 per hour. To raise the limit, set a GITHUB_TOKEN environment variable:

export GITHUB_TOKEN=ghp_...
bump-github-actions

Programmatic API

The package exports its core functions for use in scripts and other tools:

import {
  parseActions,
  getLatestVersion,
  bumpGithubActions,
} from "@jadujoel/bump-github-actions";

// Parse action references from a workflow string
const actions = parseActions(workflowContent);

// Look up the latest version of a specific action
const latest = await getLatestVersion("actions", "checkout");

// Run the full scan-and-bump pipeline
await bumpGithubActions();

How it works

1. Globs all *.yml and *.yaml files in .github/workflows.
2. Extracts every uses: owner/repo@vX reference via regex.
3. Fetches tags from https://api.github.com/repos/{owner}/{repo}/tags for each unique action.
4. Determines the highest major version, preferring short tags (v5) over full semver (v5.2.1) when both exist.
5. Rewrites workflow files in place, updating only the actions that have a newer major version available.

Requirements

• Bun runtime

License

MIT