Catch deprecations before they surprise your build.
Changes.Watch Deprecation Scan is the planned privacy-first CI check for npm, pnpm, and Yarn projects. It will match exact installed packages to registry warnings and human-verified vendor migration deadlines from the public Changes.Watch catalog.
Not installable yet.
The repository name and major-version identifier are reserved, but a public, tested ChangesWatch/deprecation-scan@v1 release does not exist yet. The examples below document the intended v1 contract; do not add them to a live workflow until this page is marked Beta and links to the published repository.
Intended minimal workflow
The first release will be warn-only by default and require only read access to repository contents. No write token, pull-request permission, or secret is planned.
# Planned — do not install until the v1 release is published.
name: Changes.Watch deprecation scan
on:
pull_request:
permissions:
contents: read
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: ChangesWatch/deprecation-scan@v1
with:
upcoming-days: 30
fail-on: neverFind deadlines even when dependencies do not change
A scheduled workflow will re-check the daily catalog for new vendor notices and approaching deadlines. The manual trigger makes rollout and troubleshooting easier.
# Planned — do not install until the v1 release is published.
name: Weekly deprecation scan
on:
schedule:
- cron: "0 8 * * 1"
workflow_dispatch:
permissions:
contents: read
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: ChangesWatch/deprecation-scan@v1
with:
fail-on: neverInputs
path.Repository directory to scan.
config.changes-watch.jsonOptional service and policy configuration.
upcoming-days30Window for upcoming verified migration deadlines.
include-transitivetrueInspect resolved transitive packages when a lockfile is available.
fail-onneverThe first release reports findings without blocking the workflow.
Outputs
deadline-passed-countVerified deprecations whose effective date has passed.
upcoming-countVerified deadlines inside the configured upcoming window.
deprecated-package-countExact installed packages marked deprecated.
scan-completeWhether all required local and fixed network sources completed.
report-pathRunner-local path to the structured scan report.
JavaScript monorepos
The MVP targets package.json, package-lock.json, pnpm-lock.yaml, Yarn lockfiles, npm/pnpm/Yarn workspaces, and common monorepo layouts. Lockfiles provide exact versions; manifest-only ranges will be reported as unresolved.
Evidence, not guesses
Job summaries will separate passed deadlines, upcoming deadlines, registry deprecations, unknown dates, and incomplete scans. Vendor findings retain their official source and Changes.Watch detail link.
Repository files stay inside the GitHub runner.
The scanner will read manifests and lockfiles locally. It will not upload repository files or package manifests to Changes.Watch. Network access will be limited to the fixed public Changes.Watch catalog and supported package registries, with bounded requests, timeouts, schema validation, and no package-manager lifecycle scripts.