Add component-mortality checks to CI

What the action does

The action reads the manifests in your repository (workflow files, Dockerfiles, package.json, requirements.txt), asks the free API which of the referenced components it has observed to be in a dead state (deleted, abandoned, dormant, or archived), and places an inline warning annotation at the exact line that references such a component. It is silent when nothing referenced is in a dead state. The annotations are advisory only and do not fail your build.

Add it to a workflow

Default mode — minimal permissions. The action emits workflow-command annotations that appear on the run and inline on changed files:

permissions:
  contents: read
  checks: write
jobs:
  component-mortality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: lastseen-dev/component-maintenance-action@v1
        with:
          api_base: https://api.lastseen.dev

Opt-in mode — in addition to the workflow-command annotations, the action publishes a dedicated check run so the annotations also surface on the pull request. This mode requests the extra pull-requests: write permission and sets pr_annotations: 'true':

permissions:
  contents: read
  checks: write
  pull-requests: write
jobs:
  component-mortality:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: lastseen-dev/component-maintenance-action@v1
        with:
          api_base: https://api.lastseen.dev
          pr_annotations: 'true'

Permissions — two modes

• Default / minimal: contents: read and checks: write. Annotations appear on the workflow's own check run and inline on changed files. Leave pr_annotations at its default of false.
• Opt-in PR annotations: additionally pull-requests: write, with pr_annotations: 'true'. This posts annotations on the pull request via a check run. It posts annotations only — it does not write a pull-request comment.

Privacy — names-only payload

The action sends only component identifiers (names, plus a category tag such as github-action or npm-package) to the API. It never sends repository content: no file paths, no line numbers, and no raw file text leave the runner. The (file, line) pair is used locally, only to position the annotation. The names-only payload is asserted in code before any request is sent. The calling organisation slug is logged at the organisation level so the free service can see who calls it — never a person. See the privacy page.

Marketplace listing

The action is built and tested. Its GitHub Marketplace listing is held and has not been submitted: [MARKETPLACE: held — not yet submitted]. Until it is listed, the uses: coordinate above is a placeholder.