Deno's dependencies have `deno outdated`, a lockfile and a `--frozen`
install. The layer underneath CI has none of that: the actions a workflow
runs and the images it runs them in are named by tags, a tag is a movable
pointer rather than a version, and nothing was watching them. That cuts both
ways — a tag can move under us, and a tag we pin can go stale for a year
without anybody noticing.

So: `tools/dep-check` reads `.forgejo/workflows/*.yml` and `docker/Dockerfile`,
asks each registry or forge which tags exist, and puts the answer where
decisions actually get made. `.forgejo/workflows/deps.yml` runs it every
Monday morning.

Built to survive being ignored, because a weekly job that files a fresh issue
every run is a job people mute, and a muted job is worse than no job — it
looks like coverage:

- one issue per dependency, edited when the newest version moves, never
  duplicated;
- an issue closed without upgrading is a decision. It is not reopened, and
  nothing more is said about that dependency until something newer than the
  version that was declined ships;
- when the repository catches up, the run comments and closes the issue;
- a run that finds nothing new writes nothing at all.

Matching is shape-first: the non-numeric parts of a tag are a deployment
choice, not a version, so `bin-2.5.6` is never offered as an upgrade to
`2.5.6` and `bookworm-slim` is reported as having no version to compare
rather than as up to date. Within a shape a missing component counts as zero,
so `v6` is behind `v6.0.1` — the opposite of the docker module's rule, and
the reason is written down next to it: these are releases, not image pins.

A commit-pinned action keeps answering through its `# v6` trailing comment,
so the checker still works after its own advice is taken. Digest-pinned
images keep their tag, so they need nothing.

Verified against the real registries: 6 dependencies discovered, five behind
(checkout v7.0.1, deno 2.9.5, three docker actions), one unversioned.
`--dry-run` does every read and no write.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

@@ -0,0 +8,4 @@
+# Monday morning, before the week's work starts. Forgejo only runs scheduled
+# workflows from the default branch, so changes here take effect once merged.
+on:
+  schedule:

@@ -0,0 +15,4 @@
+  workflow_dispatch:
+
+jobs:
+  dependencies:

@@ -0,0 +26,4 @@
+
+      # the checker is part of the repository, so it is held to the same bar
+      # as the rest of it — a broken checker must fail here, not on Monday
+      - name: Typecheck

@@ -0,0 +4,4 @@
+
+- **Deno packages** (`deno.json`, `deno.lock`) — `deno outdated` answers for
+  these, the lockfile keeps a resolve reproducible, and CI installs with
+  `--frozen` so a stale lock fails the build instead of being resolved past.

@@ -0,0 +49,4 @@
+    const name = ref.slice(0, at);
+    const rev = ref.slice(at + 1);
+    const version = SHA.test(rev) ? comment : rev;
+    if (!version) return;

@@ -0,0 +63,4 @@
+export function workflowImagesFrom(text: string, file: string): Dependency[] {
+  const out: Dependency[] = [];
+  text.split("\n").forEach((line, i) => {
+    const m = /^\s*image:\s*["']?([^"'\s]+)["']?\s*$/.exec(line);

@@ -0,0 +91,4 @@
+    stages.has(ref.toLowerCase()) || /^\d+$/.test(ref);
+  text.split("\n").forEach((line, i) => {
+    const where = `${file}:${i + 1}`;
+    const from = /^\s*FROM\s+((?:--\S+\s+)*)(\S+)(?:\s+AS\s+(\S+))?\s*$/i.exec(

@@ -0,0 +154,4 @@
+/** every dependency declared under `.forgejo/workflows` and in the Dockerfile */
+export async function discover(root: string): Promise<Dependency[]> {
+  const found: Dependency[] = [];
+  const workflows = `${root}/.forgejo/workflows`;

@@ -0,0 +43,4 @@
+  assertEquals(actionsFrom(pinned, "build.yml")[0].version, "v6");
+});
+
+Deno.test("a pinned action with no comment says nothing rather than guessing", () => {

@@ -0,0 +72,4 @@
+   */
+  async issues(): Promise<ExistingIssue[]> {
+    const out: ExistingIssue[] = [];
+    for (let page = 1; page <= 10; page++) {

@@ -0,0 +101,4 @@
+    return labels.find((l) => l.name === name)?.id ?? null;
+  }
+
+  async create(

@@ -0,0 +36,4 @@
+}
+
+export function marker(name: string, latest: string): string {
+  return `<!-- dep-check name=${name} latest=${latest} -->`;

@@ -0,0 +91,4 @@
+    );
+  const open = mine.find((x) => x.issue.state === "open");
+
+  if (!latest) {

@@ -0,0 +96,4 @@
+      ? { do: "resolve", issue: open.issue.number }
+      : { do: "skip", why: "up to date" };
+  }
+  if (open) {

@@ -0,0 +98,4 @@
+      );
+    }
+  }
+  const existing: ExistingIssue[] = forge ? await forge.issues() : [];

@@ -0,0 +104,4 @@
+  for (const { dep, latest, source, error } of reports) {
+    if (error) continue;
+    const what = `${dep.name} ${dep.version}`;
+    const mine = existing.filter((i) => i.body.includes(`name=${dep.name} `));

@@ -0,0 +141,4 @@
+    }
+    console.log(`  + ${what}: ${latest!.tag} available, filing an issue`);
+    if (forge) {
+      const number = await forge.create(title, body, labels);

@@ -0,0 +89,4 @@
+  let token: string | null = null;
+  const tags: string[] = [];
+  try {
+    for (let page = 0; page < MAX_PAGES && url; page++) {

@@ -0,0 +134,4 @@
+    : `https://${host}/api/v1/repos/${name}/tags?limit=100`;
+}
+
+export async function listActionTags(

@@ -0,0 +18,4 @@
+# Usage: .forgejo/deno.sh test --allow-read tools/dep-check/
+set -eu
+
+IMAGE="denoland/deno:2.5.6@sha256:3ea71953ff50e3ff15c377ead1a8521f624e2f43d27713675a8bed7b33f166aa"

@@ -0,0 +31,4 @@
+id=$(docker create -w /w $env_args "$IMAGE" deno "$@")
+trap 'docker rm -f "$id" >/dev/null 2>&1 || true' EXIT
+
+docker cp . "$id:/w" >/dev/null

@@ -0,0 +20,4 @@
+#
+# checked against the key the host reports for itself over an already-trusted
+# session (`ssh <host> cat /etc/ssh/ssh_host_ed25519_key.pub`).
+192.168.0.3 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICgU0tgg/3hqPSKtwmnTyG+6DEQSVxygoMj5wXlJS998

@@ -0,0 +17,4 @@
+  # Without this the workflow, the checkout and the tool's own entry point
+  # would first execute unattended on a Monday, against the live tracker —
+  # the one place where "it has never run" is least acceptable.
+  pull_request:

@@ -20,3 +20,3 @@
     "build": "deno task build:shell && deno task build:shared && deno task build:modules",
     "start": "deno run --allow-read --allow-write=data --allow-env --allow-net --allow-ffi --allow-run packages/server/main.ts",
-    "check": "deno check packages/server/main.ts",
+    "check": "deno check packages/server/main.ts tools/dep-check/main.ts",

@@ -50,3 +50,3 @@
 
   // admin-only mutation
-  ctx.router.post("/things", ctx.auth.requireRole("admin"), (c) => c.json({ ok: true }));
+  ctx.router.post(

@@ -0,0 +225,4 @@
+  ".claude",
+]);
+
+const WORKFLOW_DIRS = [".forgejo/workflows", ".github/workflows"];

@@ -0,0 +40,4 @@
+ * its own. Not the declared version either: bumping `v6` to `v6.5` would
+ * orphan the issue and file a duplicate. The shape is what stays put.
+ */
+export const depKey = (dep: Dependency): string =>

@@ -0,0 +46,4 @@
+  assertEquals(issueTitle(DEP, V7), "deps(action): actions/checkout v6 → v7");
+});
+
+Deno.test("two variants of one image have different identities", () => {

@@ -0,0 +112,4 @@
+      return 2;
+    }
+    forge = new Forge(cfg);
+    const id = await forge.label(LABEL);

@@ -0,0 +193,4 @@
+  // Red when something was actually wrong: a write that failed, a dependency
+  // nothing can watch, or every single lookup failing (one is noise, all of
+  // them is a broken checker).
+  return failed || unwatched.length || unreachable === reports.length ? 1 : 0;

@@ -0,0 +64,4 @@
+ *
+ * An unversioned tag has no shape to speak of, so it stands for itself.
+ */
+export function shapeKey(version: string): string {

@@ -0,0 +25,4 @@
+# file, so a digest written here would go stale in silence. The build stage's
+# FROM is the one declaration; it is already watched, and reading it from
+# there is also what guarantees CI runs the toolchain the image is built with.
+DOCKERFILE=docker/Dockerfile

@@ -0,0 +37,4 @@
+    # forks enabled and open registration, so the trigger is reachable by
+    # anyone; secrets are withheld from fork runs, but the runner that holds
+    # them on the next push to main is not.
+    if: >-

@@ -0,0 +41,4 @@
+ * asserting it is current. Reporting the oldest keeps the issue open until
+ * every site has moved, which is when it is actually true.
+ */
+export interface Dependency extends Declaration {

@@ -0,0 +240,4 @@
+  `${dep.kind}:${dep.name}:${shapeKey(dep.version)}`;
+
+/** strictly behind, among tags of one shape */
+function behind(a: string, b: string): boolean {

@@ -0,0 +258,4 @@
+ * `Dependency`. One key holding two versions is what let a run close an issue
+ * because one of two sites had been upgraded.
+ */
+export function fold(decls: Declaration[]): Dependency[] {

@@ -0,0 +276,4 @@
+}
+
+/** the versions this dependency is declared at, when its sites disagree */
+export function split(dep: Dependency): Declaration[] | null {

@@ -0,0 +88,4 @@
+  // one of these issues and bumping only one of the places. Said out loud
+  // here as well as in the issue, because a dry run is where it gets read.
+  for (const dep of deps) {
+    const sites = split(dep);

@@ -0,0 +139,4 @@
+      // read labels is an ordinary configuration, and aborting on it would
+      // lose the whole run to a cosmetic field.
+      console.warn(
+        `  ! could not read labels (${(e as Error).message}); filing without`,