chore(deps): remove dependabot.yml, fold action bumps into the sweep

Closes #2235.

Switches the old dependency flow off now that #2232 landed the
replacement. Removes the five npm ecosystem entries (root plus each
client under clients/*) and, resolving the question #2229 left open, the
github-actions entry as well — so .github/dependabot.yml goes away
outright rather than being emptied, which its schema does not allow.

The github-actions entry had exactly the property #2229 exists to
remove: it opened a grouped monthly PR carrying no `Closes #N` and no
board card, the one standing exception to "every PR references an
issue". Deleting it unreplaced would have left 9 actions unwatched, and
`npm outdated` says nothing about actions, so the monthly sweep now also
checks every `uses:` ref under .github/workflows and renders the stale
ones as one more section of the same tracking issue.

Ranking comes from the release LIST, not `releases/latest`. That
endpoint returns the release GitHub designates most recent, not the
greatest version, so an action publishing a maintenance release for an
older major (a v6.9.1 cut after v8.0.0) would make a workflow pinned to
v7 compare against v6 and read as current — silently missing a whole
major upgrade, the one thing this check exists to catch.

Staleness is compared only to the precision the ref specifies. `v7` is a
moving major tag that GitHub repoints at every v7.x release, so `v7`
against a highest of `v7.0.1` is current and only `v8` makes it stale;
an exactly-pinned `v7.0.0` is behind `v7.0.1`; a SHA pin is deliberately
immovable and is never reported.

A release lookup suppresses only a 404 — the legitimate "this action has
never cut a release" answer — and throws on anything else. Treating a
rate limit or an expired token as "no release" is indistinguishable from
"not stale", and since every action here already sits on its latest
major, the resulting empty section is byte-identical to a healthy run.

`buildClearedBody` now speaks for both halves: once actions are in scope,
its npm-only wording would assert a clean bill of health the sweep never
checked.

Dependabot security updates are unaffected — they are configured in repo
settings, not in this file, and kept working while it was missing
entirely (#1833, #1840). That note moves into the workflow header rather
than dying with the file; #2233 is where they are turned off
deliberately. The script header, the workflow header and the generated
issue body all say version-update PRs rather than claiming Dependabot is
replaced wholesale.

Also renames the workflow's npm-outdated job to dependency-sweep now
that the sweep is no longer npm-only.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NGtzPg3UxMLszysQXXfqax
Signed-off-by: cliffhall <cliff@futurescale.com>

.github/dependabot.yml

@@ -1,93 +0,0 @@
-version: 2
-
-# Version updates target `v2/main`, the develop branch where all v2 work lands,
-# not the default branch — `main` is release-only, holding the latest released
-# v2 and receiving milestone merges from `v2/main`. (The deprecated v1 line
-# lives on `v1/main` and takes security fixes only.)
-#
-# Two things to know about this file:
-#   1. Dependabot reads it from the DEFAULT branch (`main`). Changes here are
-#      inert until the next milestone merge carries them there.
-#   2. `target-branch` scopes VERSION updates. Dependabot SECURITY updates are
-#      enabled in repo settings, not here, and are raised against the default
-#      branch — they kept working while this file was missing entirely
-#      (see #1833, #1840). Per GitHub's Dependabot options reference, an entry
-#      whose `target-branch` names a non-default branch is NOT applied to
-#      security updates, so the schedule/labels/groups below shape version
-#      updates only. Re-confirm security PRs still appear after this lands.
-#
-# v2 is not an npm workspace: the root and each client under `clients/*` carry
-# their own package.json + lockfile, so each needs its own entry.
-
-updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    target-branch: "v2/main"
-    schedule:
-      interval: "monthly"
-    labels:
-      - "v2"
-    groups:
-      github-actions:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "npm"
-    directory: "/"
-    target-branch: "v2/main"
-    schedule:
-      interval: "monthly"
-    labels:
-      - "v2"
-    groups:
-      root-dependencies:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "npm"
-    directory: "/clients/web"
-    target-branch: "v2/main"
-    schedule:
-      interval: "monthly"
-    labels:
-      - "v2"
-    groups:
-      web-dependencies:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "npm"
-    directory: "/clients/cli"
-    target-branch: "v2/main"
-    schedule:
-      interval: "monthly"
-    labels:
-      - "v2"
-    groups:
-      cli-dependencies:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "npm"
-    directory: "/clients/tui"
-    target-branch: "v2/main"
-    schedule:
-      interval: "monthly"
-    labels:
-      - "v2"
-    groups:
-      tui-dependencies:
-        patterns:
-          - "*"
-
-  - package-ecosystem: "npm"
-    directory: "/clients/launcher"
-    target-branch: "v2/main"
-    schedule:
-      interval: "monthly"
-    labels:
-      - "v2"
-    groups:
-      launcher-dependencies:
-        patterns:
-          - "*"

.github/workflows/dependency-refresh.yml

@@ -1,21 +1,27 @@
-# Monthly npm-outdated sweep (#2229), replacing Dependabot version-update PRs.
+# Monthly dependency sweep (#2229), replacing Dependabot's VERSION-UPDATE PRs.
 #
-# A Dependabot version-update PR carries no issue and no board card, so npm
+# A Dependabot version-update PR carries no issue and no board card, so
-# version updates are being switched off in `.github/dependabot.yml`. That file
+# `.github/dependabot.yml` was removed outright in #2235 — npm and
-# is changed in #2235, not here — until it lands, Dependabot's npm PRs and this
+# github-actions alike. This workflow is what replaced those PRs (security
-# sweep overlap, which is duplicate signal rather than conflicting action.
+# updates are a separate mechanism and stay on; see below): it runs
+# `scripts/dependency-refresh.mjs` against `v2/main` once a month and files or
+# updates ONE tracking issue listing every outdated npm package across the root
+# install and each client, plus any workflow `uses:` ref behind its action's
+# highest released version. No PR is opened automatically. A maintainer
+# reviews the
+# issue, picks what to bump, and opens a normal PR against `v2/main`.
 #
-# This workflow runs `scripts/dependency-refresh.mjs` against `v2/main` once a
+# Dependabot SECURITY updates are unaffected: they are enabled in repo
-# month and files or updates ONE tracking issue listing every outdated package
+# settings, not in a config file, and kept working while `dependabot.yml` was
-# across the root install and each client — no PR is opened automatically. A
+# missing entirely (see #1833, #1840). They are raised against the default
-# maintainer reviews the issue, picks what to bump, and opens a normal PR
+# branch and still need retargeting by hand.
-# against `v2/main`.
 #
-# `GITHUB_TOKEN` is sufficient: it only needs to read milestones (public) and
+# `GITHUB_TOKEN` is sufficient: it only needs to read milestones and the public
-# create/edit an issue (`issues: write`). Board placement is intentionally NOT
+# release feeds of the actions we use, and to create/edit an issue
-# attempted here — that needs an org-project PAT this token cannot have — so a
+# (`issues: write`). Board placement is intentionally NOT attempted here — that
-# filed-but-unboarded issue is picked up by the next `/issue-triage` sweep,
+# needs an org-project PAT this token cannot have — so a filed-but-unboarded
-# same as any other maintainer-filed issue.
+# issue is picked up by the next `/issue-triage` sweep, same as any other
+# maintainer-filed issue.
 name: Dependency Refresh
 
 on:
@@ -28,7 +34,7 @@ permissions:
   issues: write
 
 jobs:
-  npm-outdated:
+  dependency-sweep:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout v2/main
@@ -45,7 +51,7 @@ jobs:
       - name: Install dependencies (root + all clients)
         run: npm install
 
-      - name: Run the npm-outdated sweep
+      - name: Run the dependency sweep (npm packages + workflow actions)
         run: node scripts/dependency-refresh.mjs
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

scripts/dependency-refresh.mjs

@@ -1,23 +1,36 @@
 #!/usr/bin/env node
-// Monthly npm-outdated sweep (#2229), replacing Dependabot version-update PRs.
+// Monthly dependency sweep (#2229), replacing Dependabot's VERSION-UPDATE PRs.
 //
 // A Dependabot version-update PR carries no issue and no board card — the same
 // carve-out from "every PR references an issue" that the security-update flow
 // had (that half is handled separately by the alert-driven pipeline, also
-// #2229). Turning npm version updates off in `.github/dependabot.yml` is #2235;
+// #2229). #2235 removed `.github/dependabot.yml` outright, so Dependabot opens
-// this script is the replacement it switches over to, and lands first, so the
+// no version-update PRs against this repo at all and this script is what
-// two flows overlap until #2235 does. Once a month it runs
+// replaced them. Dependabot SECURITY updates are a separate mechanism, enabled
-// `npm outdated` across the root install and every client under `clients/*`
+// in repo settings rather than in that file, and are deliberately still on —
-// (each has its own package.json + lockfile — v2 is not a workspace), and
+// so this replaces the version-update half only, not Dependabot wholesale.
-// files or updates ONE tracking issue listing everything behind. A maintainer
+//
-// picks what to bump and opens a normal PR against `v2/main`; there is no
+// Once a month it runs `npm outdated` across the root install and every client
-// auto-generated PR here at all.
+// under `clients/*` (each has its own package.json + lockfile — v2 is not a
+// workspace), checks every `uses:` ref under `.github/workflows` against that
+// action's highest released version, and files or updates ONE tracking issue
+// listing everything behind. A maintainer picks what to bump and opens a
+// normal PR against `v2/main`; there is no auto-generated PR here at all.
+//
+// The actions half is here rather than left on Dependabot because the
+// `github-actions` entry had exactly the property #2229 exists to remove: it
+// opened a grouped monthly PR carrying no `Closes #N` and no board card.
+// Deleting that entry without replacing it would have left action versions
+// unwatched, and `npm outdated` says nothing about actions — hence the
+// separate release lookup below.
 //
 // Idempotent by design: the issue body starts with a fixed HTML marker
 // (ISSUE_MARKER below), which is how a second run in the same month finds and
 // updates the existing open issue instead of filing a duplicate.
 //
-// `parseOutdated`, `buildIssueBody` and `buildClearedBody` are pure. `main()`
+// `parseOutdated`, `parseActionRefs`, `parseVersionRef`, `isActionStale`,
+// `staleActions`, `isMissingRelease`, `highestVersionTag`, `buildIssueBody`
+// and `buildClearedBody` are pure. `main()`
 // shells out to `npm outdated` and `gh`, so it takes its spawn function as a
 // parameter (defaulting to the real one) and `dependency-refresh.test.mjs`
 // drives it with a fake — covering npm failure, create vs. edit, the milestone
@@ -26,6 +39,8 @@
 // non-zero `npm outdated` exit report a clean sweep.
 
 import { spawnSync } from "node:child_process";
+import { readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
 
 export const ISSUE_MARKER = "<!-- dependency-refresh:monthly-sweep -->";
 
@@ -38,6 +53,9 @@ export const INSTALLS = [
   { dir: "clients/launcher", label: "clients/launcher" },
 ];
 
+/** Where the `uses:` refs this sweep checks live, relative to the repo root. */
+export const WORKFLOW_DIR = ".github/workflows";
+
 /**
  * Normalize one install's `npm outdated --json` output.
  *
@@ -59,12 +77,98 @@ export function parseOutdated(json) {
 }
 
 /**
- * @param {Array<{label: string, packages: ReturnType<typeof parseOutdated>}>} installs
+ * Pull every action reference out of one workflow file.
- * @returns {string | null} the issue body, or `null` when nothing is outdated anywhere
+ *
+ * Deliberately a line regex rather than a YAML parse: `uses:` is always a
+ * scalar on its own line in this repo's workflows, and a real parser would be
+ * this script's only dependency. Local (`./…`) and container (`docker://…`)
+ * steps are skipped — neither has a releases feed to compare against — as is
+ * an unpinned `uses:` with no `@ref` at all.
+ *
+ * @param {string} yaml raw contents of a workflow file
+ * @returns {Array<{action: string, ref: string}>} in file order, duplicates kept
  */
-export function buildIssueBody(installs) {
+export function parseActionRefs(yaml) {
+  const refs = [];
+  for (const line of yaml.split("\n")) {
+    const match = /^\s*(?:-\s+)?uses:\s*(?:"([^"]+)"|'([^']+)'|([^\s#]+))/.exec(
+      line,
+    );
+    if (!match) continue;
+    const uses = match[1] ?? match[2] ?? match[3];
+    if (uses.startsWith("./") || uses.startsWith("docker://")) continue;
+    const at = uses.lastIndexOf("@");
+    if (at === -1) continue;
+    refs.push({ action: uses.slice(0, at), ref: uses.slice(at + 1) });
+  }
+  return refs;
+}
+
+/**
+ * Split a `v`-prefixed numeric ref into its components, or `null` when it is
+ * not one — a SHA pin or a branch name, which a tag comparison cannot rank.
+ *
+ * @param {string} ref e.g. `v7`, `v7.0`, `7.0.1`
+ * @returns {number[] | null}
+ */
+export function parseVersionRef(ref) {
+  const match = /^v?(\d+)(?:\.(\d+))?(?:\.(\d+))?$/.exec(ref);
+  if (!match) return null;
+  return match
+    .slice(1)
+    .filter((part) => part !== undefined)
+    .map(Number);
+}
+
+/**
+ * Is `current` behind `latest`?
+ *
+ * Compared only to the precision `current` actually specifies, because that is
+ * what pinning to it means: `v7` is a moving major tag that GitHub repoints at
+ * every `v7.x` release, so `v7` against a latest of `v7.0.1` is up to date and
+ * only `v8` makes it stale. An exactly-pinned `v7.0.0` *is* behind `v7.0.1`.
+ *
+ * @param {string} current the `uses:` ref
+ * @param {string} latest the action's latest release tag
+ * @returns {boolean} `false` when either side is not a numeric ref
+ */
+export function isActionStale(current, latest) {
+  const from = parseVersionRef(current);
+  const to = parseVersionRef(latest);
+  if (from === null || to === null) return false;
+  for (let i = 0; i < from.length; i++) {
+    const other = to[i] ?? 0;
+    if (other !== from[i]) return other > from[i];
+  }
+  return false;
+}
+
+/**
+ * @param {Array<{action: string, ref: string}>} refs every ref found across the workflows
+ * @param {Record<string, string | null>} latestByAction latest release tag per action, `null` when unknown
+ * @returns {Array<{action: string, current: string, latest: string}>} the stale ones, deduped and sorted
+ */
+export function staleActions(refs, latestByAction) {
+  const stale = new Map();
+  for (const { action, ref } of refs) {
+    const latest = latestByAction[action];
+    if (!latest || !isActionStale(ref, latest)) continue;
+    stale.set(`${action}@${ref}`, { action, current: ref, latest });
+  }
+  return [...stale.values()].sort(
+    (a, b) =>
+      a.action.localeCompare(b.action) || a.current.localeCompare(b.current),
+  );
+}
+
+/**
+ * @param {Array<{label: string, packages: ReturnType<typeof parseOutdated>}>} installs
+ * @param {ReturnType<typeof staleActions>} actions
+ * @returns {string | null} the issue body, or `null` when nothing is behind anywhere
+ */
+export function buildIssueBody(installs, actions = []) {
   const withPackages = installs.filter((i) => i.packages.length > 0);
-  if (withPackages.length === 0) return null;
+  if (withPackages.length === 0 && actions.length === 0) return null;
 
   const sections = withPackages.map(({ label, packages }) => {
     const rows = packages
@@ -75,9 +179,18 @@ export function buildIssueBody(installs) {
     return `### \`${label}\`\n\n| Package | Current | Wanted | Latest |\n| --- | --- | --- | --- |\n${rows}`;
   });
 
+  if (actions.length > 0) {
+    const rows = actions
+      .map((a) => `| \`${a.action}\` | ${a.current} | ${a.latest} |`)
+      .join("\n");
+    sections.push(
+      `### GitHub Actions\n\n| Action | Current | Latest |\n| --- | --- | --- |\n${rows}`,
+    );
+  }
+
   return [
     ISSUE_MARKER,
-    "Routine dependency refresh — `npm outdated` run against `v2/main` on a monthly schedule, replacing Dependabot version-update PRs (#2229).",
+    "Routine dependency refresh — `npm outdated` plus a workflow `uses:` check, run against `v2/main` on a monthly schedule. This sweep replaces Dependabot's version-update PRs (#2229, #2235); Dependabot security updates are a separate mechanism and remain enabled.",
     "",
     "This is a tracking issue, not a diff: pick what's worth bumping (`wanted` is the safe default; `latest` may cross a major and needs its own judgment call, especially for anything root-declared per [Dependency placement](https://github.com/modelcontextprotocol/inspector/blob/v2/main/AGENTS.md#dependency-placement)) and open a normal PR against `v2/main`.",
     "",
@@ -88,9 +201,14 @@ export function buildIssueBody(installs) {
 }
 
 /**
- * The body a still-open tracking issue is rewritten to once every install is
+ * The body a still-open tracking issue is rewritten to once every install AND
- * current again. Without it the issue keeps its last package table forever and
+ * every workflow action is current again. Without it the issue keeps its last
- * reads as live work that no longer exists (Copilot).
+ * table forever and reads as live work that no longer exists (Copilot).
+ *
+ * It has to speak for both halves of the sweep: once actions are in scope
+ * (#2235), npm-only wording here would assert a clean bill of health the sweep
+ * never checked, which is the same silent-all-clear shape the rest of this
+ * file guards against.
  *
  * The sweep rewrites rather than closes: it deliberately takes no board
  * actions (see the workflow header), and closing an issue whose card a
@@ -103,11 +221,11 @@ export function buildIssueBody(installs) {
 export function buildClearedBody(isoDate) {
   return [
     ISSUE_MARKER,
-    `Every install is up to date as of ${isoDate} — nothing is outdated at the root or in any client.`,
+    `Everything this sweep watches is current as of ${isoDate} — no npm package is outdated at the root or in any client, and no workflow \`uses:\` ref is behind its action's highest release.`,
     "",
-    "This issue was filed by an earlier run of the monthly sweep (#2229) and its package table is gone because the packages it listed are no longer behind. Either they were bumped or their ranges caught up; nothing here is outstanding.",
+    "This issue was filed by an earlier run of the monthly sweep (#2229, #2235) and its tables are gone because nothing they listed is behind any more. Either it was bumped or the ranges caught up; nothing here is outstanding.",
     "",
-    "Safe to close. A later sweep that finds something outdated will refile this body with a fresh table rather than open a duplicate.",
+    "Safe to close. A later sweep that finds something behind will refile this body with fresh tables rather than open a duplicate.",
   ].join("\n");
 }
 
@@ -132,6 +250,107 @@ function runOutdated(dir, spawn) {
   return result.stdout ?? "";
 }
 
+function collectActionRefs() {
+  return readdirSync(WORKFLOW_DIR)
+    .filter((file) => /\.ya?ml$/.test(file))
+    .flatMap((file) =>
+      parseActionRefs(readFileSync(join(WORKFLOW_DIR, file), "utf8")),
+    );
+}
+
+/**
+ * Is this failed release lookup the expected "publishes no releases" answer?
+ *
+ * `repos/<owner>/<repo>/releases/latest` 404s when an action has never cut a
+ * GitHub release, which is a legitimate state and must not fail the sweep.
+ * Every OTHER failure — a rate limit, an expired token, a transient 5xx — must,
+ * because treating it as "no release" is indistinguishable from "not stale":
+ * the sweep would exit green having silently checked nothing, and since this
+ * repo's actions are all on their latest major the empty section would look
+ * exactly like a healthy run (Copilot).
+ *
+ * @param {string} stderr stderr from a non-zero `gh api` call
+ * @returns {boolean}
+ */
+export function isMissingRelease(stderr) {
+  return /HTTP 404/.test(stderr);
+}
+
+/**
+ * The highest parseable version among these tags, or `null` if none parse.
+ *
+ * Deliberately NOT `releases/latest`, which is GitHub's *designated* most
+ * recent release rather than the greatest version: an action that ships a
+ * maintenance release for an older major (a `v6.9.1` cut after `v8.0.0`) makes
+ * `releases/latest` report `v6.9.1`, and a workflow pinned to `v7` would then
+ * compare against v6 and read as current — silently missing a whole major
+ * upgrade, which is the one thing this check exists to catch (Copilot).
+ *
+ * @param {string[]} tags release tag names, in any order
+ * @returns {string | null}
+ */
+export function highestVersionTag(tags) {
+  let best = null;
+  let bestParts = null;
+  for (const tag of tags) {
+    const parts = parseVersionRef(tag);
+    if (parts === null) continue;
+    if (bestParts === null || comparePadded(parts, bestParts) > 0) {
+      best = tag;
+      bestParts = parts;
+    }
+  }
+  return best;
+}
+
+/** Compare two version component arrays, padding the shorter with zeroes. */
+function comparePadded(a, b) {
+  for (let i = 0; i < Math.max(a.length, b.length); i++) {
+    const diff = (a[i] ?? 0) - (b[i] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+
+/**
+ * The action's highest released version tag, or `null` when it has none.
+ *
+ * Reads the release *list* rather than `releases/latest`, for the reason on
+ * `highestVersionTag`. Drafts and prereleases are excluded — neither is
+ * something a workflow should be told to move to. One page of 100 is taken
+ * rather than paginating every release an action has ever cut: the list comes
+ * back newest-first, so the greatest version is within it for any real action.
+ *
+ * @throws when the lookup fails for any reason other than a 404
+ */
+function latestReleaseTag(action, spawn) {
+  // `owner/repo/subpath@ref` is a valid `uses:`; releases live on `owner/repo`.
+  const repo = action.split("/").slice(0, 2).join("/");
+  const result = spawn(
+    "gh",
+    [
+      "api",
+      `repos/${repo}/releases?per_page=100`,
+      "--jq",
+      '[.[] | select(.draft == false and .prerelease == false) | .tag_name] | join("\\n")',
+    ],
+    { encoding: "utf8" },
+  );
+  if (result.error) throw result.error;
+  if (result.status !== 0) {
+    const stderr = result.stderr ?? "";
+    // A repo with no releases returns `[]`, not a 404 — but a renamed or
+    // deleted action really is gone, and that is not a reason to fail.
+    if (isMissingRelease(stderr)) return null;
+    throw new Error(`release lookup for ${repo} failed: ${stderr.trim()}`);
+  }
+  const tags = result.stdout
+    .split("\n")
+    .map((line) => line.trim())
+    .filter(Boolean);
+  return highestVersionTag(tags);
+}
+
 function findExistingIssue(repo, spawn) {
   const result = spawn(
     "gh",
@@ -193,15 +412,24 @@ export function main(repo = process.env.GITHUB_REPOSITORY, spawn = spawnSync) {
     packages: parseOutdated(runOutdated(dir, spawn)),
   }));
 
+  const refs = collectActionRefs();
+  const latestByAction = Object.fromEntries(
+    [...new Set(refs.map((r) => r.action))].map((action) => [
+      action,
+      latestReleaseTag(action, spawn),
+    ]),
+  );
+  const actions = staleActions(refs, latestByAction);
+
   // Look the existing issue up BEFORE branching on `body`: the nothing-
-  // outdated case still has to reach an open issue to clear it.
+  // behind case still has to reach an open issue to clear it.
   const existing = findExistingIssue(repo, spawn);
-  const body = buildIssueBody(installs);
+  const body = buildIssueBody(installs, actions);
 
   if (body === null) {
     if (!existing) {
       console.log(
-        "dependency-refresh: nothing outdated in any install — no-op",
+        "dependency-refresh: nothing outdated, no stale actions — no-op",
       );
       return;
     }
@@ -212,7 +440,7 @@ export function main(repo = process.env.GITHUB_REPOSITORY, spawn = spawnSync) {
       spawn,
     );
     console.log(
-      `dependency-refresh: nothing outdated — cleared stale list on #${existing.number}`,
+      `dependency-refresh: nothing behind — cleared stale list on #${existing.number}`,
     );
     return;
   }

scripts/dependency-refresh.test.mjs

@@ -12,8 +12,14 @@ import assert from "node:assert/strict";
 import {
   buildClearedBody,
   buildIssueBody,
+  highestVersionTag,
+  isActionStale,
+  isMissingRelease,
   main,
+  parseActionRefs,
   parseOutdated,
+  parseVersionRef,
+  staleActions,
   INSTALLS,
   ISSUE_MARKER,
 } from "./dependency-refresh.mjs";
@@ -26,12 +32,18 @@ import {
  * @param {number} [opts.outdatedStatus] exit status for every `npm outdated`
  * @param {Array<{number:number,body:string}>} [opts.existing] what `gh issue list` returns
  * @param {string|null} [opts.milestone] what the milestone lookup returns
+ * @param {string[]} [opts.releaseTags] tags every action's release list returns
+ * @param {number} [opts.releasesStatus] exit status for every release lookup
+ * @param {string} [opts.releasesStderr] stderr for a failing release lookup
  */
 function fakeSpawn({
   outdated = {},
   outdatedStatus,
   existing = [],
   milestone = "v2.6.0",
+  releaseTags = [],
+  releasesStatus,
+  releasesStderr = "",
 } = {}) {
   const calls = [];
   const fn = (cmd, args, opts) => {
@@ -48,6 +60,15 @@ function fakeSpawn({
     }
     if (args[0] === "issue" && args[1] === "list")
       return { status: 0, stdout: JSON.stringify(existing), stderr: "" };
+    // MUST be tested before the milestone branch below: both are `gh api`,
+    // so matching on args[0] alone hands the release lookup the milestone
+    // string and the assertion silently checks nothing.
+    if (args[0] === "api" && args[1].includes("/releases"))
+      return {
+        status: releasesStatus ?? 0,
+        stdout: releasesStatus ? "" : releaseTags.join("\n"),
+        stderr: releasesStderr,
+      };
     if (args[0] === "api")
       return {
         status: 0,
@@ -107,6 +128,112 @@ test("parseOutdated falls back when a field is missing", () => {
   ]);
 });
 
+test("parseActionRefs pulls owner/repo@ref out of a workflow, in file order", () => {
+  const yaml = [
+    "jobs:",
+    "  build:",
+    "    steps:",
+    "      - uses: actions/checkout@v7",
+    "      - name: Setup",
+    "        uses: actions/setup-node@v7",
+    '      - uses: "docker/login-action@v4"',
+    "      - uses: docker/build-push-action@v7 # trailing comment",
+  ].join("\n");
+  assert.deepEqual(parseActionRefs(yaml), [
+    { action: "actions/checkout", ref: "v7" },
+    { action: "actions/setup-node", ref: "v7" },
+    { action: "docker/login-action", ref: "v4" },
+    { action: "docker/build-push-action", ref: "v7" },
+  ]);
+});
+
+test("parseActionRefs skips local, container and unpinned steps", () => {
+  const yaml = [
+    "      - uses: ./.github/actions/local",
+    "      - uses: docker://alpine:3.20",
+    "      - uses: actions/checkout",
+    "      - uses: github/codeql-action/init@v3",
+  ].join("\n");
+  assert.deepEqual(parseActionRefs(yaml), [
+    { action: "github/codeql-action/init", ref: "v3" },
+  ]);
+});
+
+test("parseVersionRef reads a numeric ref and rejects anything else", () => {
+  assert.deepEqual(parseVersionRef("v7"), [7]);
+  assert.deepEqual(parseVersionRef("7.0.1"), [7, 0, 1]);
+  assert.equal(parseVersionRef("main"), null);
+  assert.equal(
+    parseVersionRef("8f4b7f84864484a7bf31766abe9204da3cbe65b3"),
+    null,
+  );
+});
+
+test("isActionStale compares only to the precision the ref specifies", () => {
+  // `v7` is a moving major tag, so a v7.x release does not make it stale.
+  assert.equal(isActionStale("v7", "v7.0.1"), false);
+  assert.equal(isActionStale("v7", "v8.0.0"), true);
+  // An exactly-pinned ref is behind its own patch release.
+  assert.equal(isActionStale("v7.0.0", "v7.0.1"), true);
+  assert.equal(isActionStale("v7.1", "v7.0.9"), false);
+});
+
+test("isActionStale reports nothing for a ref it cannot rank", () => {
+  // A SHA pin is deliberately immovable; a tag comparison says nothing about it.
+  assert.equal(
+    isActionStale("8f4b7f84864484a7bf31766abe9204da3cbe65b3", "v5"),
+    false,
+  );
+  assert.equal(isActionStale("main", "v5"), false);
+  assert.equal(isActionStale("v5", "not-a-tag"), false);
+});
+
+test("highestVersionTag picks the greatest version, not the newest entry", () => {
+  // GitHub's `releases/latest` is the DESIGNATED latest, not the greatest
+  // version: a maintenance release cut for an older major after a newer one
+  // would make a workflow on v7 read as current (Copilot).
+  assert.equal(highestVersionTag(["v6.9.1", "v8.0.0", "v7.2.0"]), "v8.0.0");
+  assert.equal(highestVersionTag(["v7", "v7.0.1"]), "v7.0.1");
+  assert.equal(highestVersionTag(["v10.0.0", "v9.9.9"]), "v10.0.0");
+});
+
+test("highestVersionTag ignores tags it cannot parse", () => {
+  assert.equal(highestVersionTag(["nightly", "v2.0.0", "latest"]), "v2.0.0");
+  assert.equal(highestVersionTag(["nightly", "latest"]), null);
+  assert.equal(highestVersionTag([]), null);
+});
+
+test("staleActions dedupes, drops actions with no known release and sorts", () => {
+  const refs = [
+    { action: "actions/checkout", ref: "v7" },
+    { action: "actions/cache", ref: "v6" },
+    { action: "actions/cache", ref: "v6" },
+    { action: "some/unreleased", ref: "v1" },
+  ];
+  assert.deepEqual(
+    staleActions(refs, {
+      "actions/cache": "v7.0.0",
+      "actions/checkout": "v7.0.1",
+      "some/unreleased": null,
+    }),
+    [{ action: "actions/cache", current: "v6", latest: "v7.0.0" }],
+  );
+});
+
+test("isMissingRelease suppresses only a 404, never a real API failure", () => {
+  // A 404 is the legitimate "this action cuts no GitHub releases" answer.
+  assert.equal(isMissingRelease("gh: Not Found (HTTP 404)"), true);
+  // Everything else must fail the sweep rather than read as "not stale" — an
+  // empty actions section is indistinguishable from a healthy run (Copilot).
+  assert.equal(
+    isMissingRelease("gh: API rate limit exceeded (HTTP 403)"),
+    false,
+  );
+  assert.equal(isMissingRelease("gh: Bad credentials (HTTP 401)"), false);
+  assert.equal(isMissingRelease("gh: Server Error (HTTP 502)"), false);
+  assert.equal(isMissingRelease(""), false);
+});
+
 test("buildIssueBody returns null when every install is up to date", () => {
   assert.equal(
     buildIssueBody([
@@ -266,3 +393,73 @@ test("main falls back to GITHUB_REPOSITORY when no repo is passed", () => {
     else process.env.GITHUB_REPOSITORY = saved;
   }
 });
+
+test("buildIssueBody renders a GitHub Actions section after the npm ones", () => {
+  const body = buildIssueBody(
+    [{ label: "root", packages: [] }],
+    [{ action: "actions/cache", current: "v6", latest: "v7.0.0" }],
+  );
+  assert.ok(body.startsWith(ISSUE_MARKER));
+  assert.ok(body.includes("### GitHub Actions"));
+  assert.ok(body.includes("| `actions/cache` | v6 | v7.0.0 |"));
+  assert.ok(!body.includes("### `root`"));
+});
+
+test("buildIssueBody returns null only when npm and actions are both clean", () => {
+  assert.equal(buildIssueBody([{ label: "root", packages: [] }], []), null);
+  assert.notEqual(
+    buildIssueBody(
+      [],
+      [{ action: "actions/cache", current: "v6", latest: "v7.0.0" }],
+    ),
+    null,
+  );
+});
+
+test("buildClearedBody speaks for both halves of the sweep", () => {
+  const body = buildClearedBody("2026-09-04");
+  assert.ok(body.startsWith(ISSUE_MARKER));
+  assert.ok(body.includes("2026-09-04"));
+  // npm-only wording here would assert an all-clear the sweep never checked.
+  assert.match(body, /npm package/);
+  assert.match(body, /uses:/);
+});
+
+test("main fails the sweep when a release lookup errors, rather than reporting no stale actions", () => {
+  // The silent-success shape one level down: a 403 read as "no release" is
+  // indistinguishable from "not stale", and every action here is already on
+  // its latest major, so the empty section would look like a healthy run.
+  const spawn = fakeSpawn({
+    releasesStatus: 1,
+    releasesStderr: "gh: API rate limit exceeded (HTTP 403)",
+  });
+  assert.throws(
+    () => captureLog(() => main("o/r", spawn)),
+    /release lookup for .* failed/,
+  );
+});
+
+test("main treats a 404 release lookup as 'this action cuts no releases'", () => {
+  const spawn = fakeSpawn({
+    releasesStatus: 1,
+    releasesStderr: "gh: Not Found (HTTP 404)",
+  });
+  const log = captureLog(() => main("o/r", spawn));
+  assert.match(log.join("\n"), /no-op/);
+});
+
+test("main asks for release lists, not the designated latest release", () => {
+  const spawn = fakeSpawn();
+  captureLog(() => main("o/r", spawn));
+  const lookups = spawn.calls.filter(
+    (c) =>
+      c.cmd === "gh" && c.args[0] === "api" && c.args[1].includes("/releases"),
+  );
+  assert.ok(lookups.length > 0, "expected at least one release lookup");
+  for (const call of lookups) {
+    // `releases/latest` is GitHub's designated latest, not the greatest
+    // version — ranking must come from the list.
+    assert.doesNotMatch(call.args[1], /releases\/latest/);
+    assert.match(call.args[1], /\/releases\?/);
+  }
+});