chore: fix knip unused export and add missing ignoreDependencies

- Remove unused LATEST_ACTIONS export from actions-versions
- Add pre-existing root devDependencies to knip ignoreDependencies
- Add test entry for github-workflow plugin

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: masseater

knip.json

@@ -6,7 +6,12 @@
   },
   "tags": ["-lintignore"],
   "ignore": [".agents/**"],
-  "ignoreDependencies": ["@r_masseater/doc-engine"],
+  "ignoreDependencies": [
+    "@r_masseater/doc-engine",
+    "@feature-sliced/steiger-plugin",
+    "@r_masseater/ops-harbor",
+    "tailwindcss"
+  ],
   "workspaces": {
     ".": {
       "entry": [".claude/hooks/*.ts"]
@@ -69,7 +74,7 @@
       "entry": ["hooks/entry/*.ts"]
     },
     "plugins/github-workflow": {
-      "entry": ["hooks/entry/*.ts"]
+      "entry": ["hooks/entry/*.ts", "hooks/*.test.ts"]
     },
     "plugins/mutils": {
       "entry": ["hooks/entry/*.ts", "skills/*/scripts/*.ts", "skills/*/*.ts"]

plugins/github-workflow/hooks/lib/actions-versions.ts

@@ -1,37 +1,9 @@
 import { readFileSync } from "node:fs";
 
-/** Known latest major versions of popular GitHub Actions (verified via gh api 2026-04) */
-const LATEST_ACTIONS: Record<string, string> = {
-  // Official GitHub Actions
-  "actions/checkout": "v6",
-  "actions/setup-node": "v6",
-  "actions/setup-python": "v6",
-  "actions/setup-java": "v5",
-  "actions/setup-go": "v6",
-  "actions/setup-dotnet": "v5",
-  "actions/cache": "v5",
-  "actions/upload-artifact": "v7",
-  "actions/download-artifact": "v8",
-  "actions/github-script": "v8",
-  "actions/dependency-review-action": "v4",
-  "actions/configure-pages": "v6",
-  "actions/deploy-pages": "v5",
-  "actions/upload-pages-artifact": "v4",
-  "actions/attest-build-provenance": "v4",
-
-  // Docker
-  "docker/build-push-action": "v7",
-  "docker/setup-buildx-action": "v4",
-  "docker/login-action": "v4",
-  "docker/setup-qemu-action": "v4",
-  "docker/metadata-action": "v6",
-
-  // Popular third-party
-  "codecov/codecov-action": "v6",
-  "softprops/action-gh-release": "v2",
-  "peter-evans/create-pull-request": "v8",
-  "dorny/paths-filter": "v4",
-  "peaceiris/actions-gh-pages": "v4",
+type ActionRef = {
+  path: string;
+  repo: string;
+  current: string;
 };
 
 type OutdatedAction = {
@@ -57,34 +29,89 @@ function readWorkflowContent(filePath: string): string | undefined {
   }
 }
 
-function findOutdatedActions(content: string): OutdatedAction[] {
-  const outdated = new Map<string, OutdatedAction>();
+function extractActionRefs(content: string): ActionRef[] {
+  const seen = new Set<string>();
+  const refs: ActionRef[] = [];
   const usesPattern = /uses:\s*([^@\s]+)@(v\d+(?:\.\d+)*)/g;
 
   for (const line of content.split("\n")) {
     if (line.trim().startsWith("#")) continue;
 
     for (const match of line.matchAll(usesPattern)) {
-      const name = match[1]!;
+      const path = match[1]!;
       const current = match[2]!;
+      const key = `${path}@${current}`;
+      if (seen.has(key)) continue;
+      seen.add(key);
 
-      const latest = LATEST_ACTIONS[name];
-      if (!latest) continue;
+      const parts = path.split("/");
+      if (parts.length < 2) continue;
+      const repo = `${parts[0]}/${parts[1]}`;
 
-      const currentMajor = parseMajorVersion(current);
-      const latestMajor = parseMajorVersion(latest);
+      refs.push({ path, repo, current });
+    }
+  }
 
-      if (currentMajor === null || latestMajor === null) continue;
-      if (currentMajor >= latestMajor) continue;
+  return refs;
+}
 
-      const key = `${name}@${current}`;
-      if (!outdated.has(key)) {
-        outdated.set(key, { name, current, latest });
-      }
+function pickMaxMajorVersion(tags: string[]): string | null {
+  let maxMajor = -1;
+  for (const tag of tags) {
+    const major = parseMajorVersion(tag);
+    if (major !== null && major > maxMajor) {
+      maxMajor = major;
     }
   }
+  return maxMajor >= 0 ? `v${maxMajor}` : null;
+}
+
+async function fetchLatestMajorVersion(repo: string): Promise<string | null> {
+  try {
+    const proc = Bun.spawn(["gh", "api", `repos/${repo}/tags?per_page=50`, "--jq", ".[].name"], {
+      stdout: "pipe",
+      stderr: "pipe",
+    });
+    await proc.exited;
+
+    const stdout = await new Response(proc.stdout).text();
+    const tags = stdout.trim().split("\n").filter(Boolean);
+
+    return pickMaxMajorVersion(tags);
+  } catch {
+    return null;
+  }
+}
+
+async function findOutdatedActions(refs: ActionRef[]): Promise<OutdatedAction[]> {
+  const uniqueRepos = [...new Set(refs.map((r) => r.repo))];
+
+  const latestByRepo = new Map<string, string>();
+  const results = await Promise.all(
+    uniqueRepos.map(async (repo) => {
+      const latest = await fetchLatestMajorVersion(repo);
+      return { repo, latest };
+    }),
+  );
+  for (const { repo, latest } of results) {
+    if (latest) latestByRepo.set(repo, latest);
+  }
+
+  const outdated: OutdatedAction[] = [];
+  for (const ref of refs) {
+    const latest = latestByRepo.get(ref.repo);
+    if (!latest) continue;
+
+    const currentMajor = parseMajorVersion(ref.current);
+    const latestMajor = parseMajorVersion(latest);
+
+    if (currentMajor === null || latestMajor === null) continue;
+    if (currentMajor >= latestMajor) continue;
+
+    outdated.push({ name: ref.path, current: ref.current, latest });
+  }
 
-  return [...outdated.values()];
+  return outdated;
 }
 
 function formatSuggestions(outdated: OutdatedAction[]): string {
@@ -101,11 +128,13 @@ function formatSuggestions(outdated: OutdatedAction[]): string {
 }
 
 export {
-  LATEST_ACTIONS,
+  extractActionRefs,
+  fetchLatestMajorVersion,
   findOutdatedActions,
   formatSuggestions,
   isGitHubWorkflowFile,
   parseMajorVersion,
+  pickMaxMajorVersion,
   readWorkflowContent,
 };
-export type { OutdatedAction };
+export type { ActionRef, OutdatedAction };