created new action that creates a GitHub issue for dependency updates

check-dependencies/README.md

@@ -0,0 +1,60 @@
+# Check Dependencies
+
+Creates an **Update dependencies** issue when the latest matching issue closed as
+completed is at least `max-age-days` old. If no completed issue exists, maintenance
+is due immediately. An open matching issue suppresses creation. Pull requests and
+issues closed as not planned do not reset the interval.
+
+Each run creates the repository's `DEPENDENCY UPDATE` label if it is missing,
+even when no new issue is due. Existing label settings are preserved. No
+organization default label configuration is required.
+
+New issues receive the `DEPENDENCY UPDATE` label. Matching recognizes that label
+(case insensitive), the hidden `<!-- check-dependencies -->` marker, or historical
+maintenance titles. Historical titles include `update dependencies` with optional
+suffixes (such as `and workflows` or `and setup OIDC publishing`),
+`Update to latest dependencies`, and `dependency / CI updates yyyy-mm-dd`.
+Title matching ignores case and surrounding whitespace. Labeled issues can have
+any title. Historical issues do not need to be relabeled to count toward the
+maintenance interval or suppress a duplicate.
+
+Recent human commit authors on the default branch are ranked by commit count,
+then latest authorship date, then username. Bots and commits without a linked
+GitHub user are excluded. The action tries each author's assignment eligibility
+in order, then `fallback-assignee`. If nobody is eligible, it creates an
+unassigned issue and logs a warning. API errors other than an ineligible
+assignee's 404 fail the action.
+
+```yaml
+name: Check Dependencies
+on:
+  schedule:
+    - cron: '0 10 * * 1-5'
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+  issues: write
+
+# Serialize checks to prevent overlapping runs from opening duplicate issues.
+concurrency:
+  group: check-dependencies
+  cancel-in-progress: false
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: checkdigit/github-actions/check-dependencies@main
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          max-age-days: '90'
+          contributor-lookback-days: '90'
+          fallback-assignee: ''
+```
+
+Both day inputs must be positive integers. `GITHUB_REPOSITORY` is supplied by
+GitHub Actions. The `issue-url` output contains the created issue URL, or an empty
+string when creation is skipped. Close maintenance issues as **completed** once
+the dependency updates are merged.

check-dependencies/action.yml

@@ -0,0 +1,19 @@
+name: Check Dependencies
+description: Check dependencies and create one overdue maintenance issue with recent-contributor ownership
+inputs:
+  max-age-days:
+    description: Days since the latest dependency-update issue closed as completed
+    default: '90'
+  contributor-lookback-days:
+    description: Days of default-branch commit authorship to rank
+    default: '90'
+  fallback-assignee:
+    description: GitHub username to try after eligible recent contributors
+    default: ''
+outputs:
+  issue-url:
+    description: GitHub URL of created issue
+runs:
+  using: node24
+  pre: '../src/setup.ts'
+  main: ../src/check-dependencies/index.ts