Changes.Watch
Free digest
Know what changed in your dev stack before it affects you.
Audit your stack →

GitHub Action · quick start

Add deprecation checks to your workflow in a few minutes.

This guide shows the smallest useful setup for pull requests, weekly monitoring, and manual runs. Start with warn-only results, then tune the workflow after you understand the findings in your repository.

Open the Action repositoryView full contract
  1. 01

    Create the file

    Add a workflow under .github/workflows/.

    In an existing repository, create deprecation-scan.yml. For a new repository, commit the file to the default branch before opening your first PR.

  2. 02

    Paste the workflow

    Start with pull requests and a weekly check.

    This example checks every pull request, runs once a week even when your dependencies do not change, and can also be started from the Actions tab.

    name: Changes.Watch deprecation scan

on:
  pull_request:
  schedule:
    - cron: "17 8 * * 1"
  workflow_dispatch:

permissions:
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: ChangesWatch/deprecation-scan@v1
        with:
          upcoming-days: 30
          include-transitive: true
          fail-on: never
  3. 03

    Run the check

    Open a PR or run it from GitHub Actions.

    The workflow checks package manifests and lockfiles locally in the GitHub runner. It does not upload repository files or package manifests to Changes.Watch.

    Pull request

    Runs automatically when a PR is opened or updated.

    Weekly

    Catches new catalog deadlines without a dependency change.

    Manual

    Use workflow_dispatch during rollout or troubleshooting.

  4. 04

    Review the result

    Read the job summary before changing dependencies.

    Findings are grouped by urgency and evidence. Follow the official source and Changes.Watch detail link before choosing a replacement or migration path.

    urgent-count

    Findings whose verified deadline has passed.

    high-count

    Findings due inside the configured upcoming window.

    attention-count

    Findings that need review without an urgent deadline.

    scan-complete

    Whether all required local and fixed network sources completed.

    report-path

    Runner-local path to the structured scan report.

Safe defaults

Keep the first rollout non-blocking.

fail-on: never reports findings without blocking the workflow. Keepcontents: read as the only permission and use upcoming-days: 30as a practical starting window.

Troubleshooting

What the first result means.

No findings

No matching deprecation signals were found in the scanned dependency graph. This is not a vulnerability scan.

Unresolved package version

Add or refresh a lockfile when possible. Manifest-only ranges do not identify one exact installed version.

Incomplete scan

Treat a partial result as needing attention, not as a definitive clean state.