Plz stop advertizing legacy `snake_case` inputs of `pypa/gh-action-pypi-publish`

[webknjaz]

It would be nice to remove things like

actionlint/popular_actions.go

Line 3104 in 8e91629

"packages_dir": {"packages_dir", false},

. I've deprecated them a while ago in favor of kebab-case consistent with GHA traditions. I'd rather have linters telling the users to normalize to the current spelling.

[rhysd]

actionlint doesn't forbid users using deprecated inputs because they're actually available. Instead they receive deprecation messages from GitHub Actions. When the deprecated inputs are removed from the metadata, the popular_actions.go will drop them when it is generated next time.

[webknjaz]

I think there's a case to be made for disallowing such inputs as it would make migration smoother.

[muzimuzhi]

As a general feature request, actionlint could raise a warning on use of an Action <input_id> if the corresponding inputs.<input_id>.deprecationMessage exists in the action.y(a)ml file.

Then pypa/gh-action-pypi-publish will gain from this feature, as it already sets deprecationMessage for soft-deprecated inputs, see for example its action.yml@v1.13.0.

[webknjaz]

As a general feature request, actionlint could raise a warning on use of an Action <input_id> if the corresponding inputs.<input_id>.deprecationMessage exists in the action.y(a)ml file.

Sounds reasonable.

see for example its

Yes, I added it there. This is my project 😉

[muzimuzhi]

see for example its

Yes, I added it there. This is my project 😉

Yes I noticed that. The "for example" was for the tag 1.13.0 of action.yml, because I found no general v1 tag. Also just realized that I should refer to the release/v1 branch head (seems unconventional?), the Git ref recorded in popular_actions.go.

actionlint/popular_actions.go

Lines 3099 to 3117 in 8e91629

	"pypa/gh-action-pypi-publish@release/v1": {
	Name: "pypi-publish",
	Inputs: ActionMetadataInputs{
	"attestations": {"attestations", false},
	"packages-dir": {"packages-dir", false},
	"packages_dir": {"packages_dir", false},
	"password": {"password", false},
	"print-hash": {"print-hash", false},
	"print_hash": {"print_hash", false},
	"repository-url": {"repository-url", false},
	"repository_url": {"repository_url", false},
	"skip-existing": {"skip-existing", false},
	"skip_existing": {"skip_existing", false},
	"user": {"user", false},
	"verbose": {"verbose", false},
	"verify-metadata": {"verify-metadata", false},
	"verify_metadata": {"verify_metadata", false},
	},
	},

[webknjaz]

Also just realized that I should refer to the release/v1 branch head (seems unconventional?)

Yeah, I didn't like that GH suggests people to force-push tags all the time. Many people assume they are immutable. And there's a convention of not changing them.
So I wanted to be clear about the "moving pointer" and use branches for major/minor versions + tags for full versions that remain immutable.

I follow this pattern in alls-green and other actions.

[muzimuzhi]

(sorry for being off-topic)

Also just realized that I should refer to the release/v1 branch head (seems unconventional?)

Yeah, I didn't like that GH suggests people to force-push tags all the time. Many people assume they are immutable.

This reminds me of the support for immutable release. It's added in Aug 2025, currently in public preview.

[webknjaz]

Yeah, multiple people told me about it and I applied way before that. But I never heard back. Though, I have seen that repos now have immutability checkboxes in settings. I haven't yet tried those and don't know if they're related to immutable actions...

[rhysd]

I changed my mind after checking how deprecationMessage is used:

https://github.com/search?q=deprecationMessage+language%3Ayaml+path%3Aaction.yml&type=code

I will add a new check which reports using deprecated inputs as error.

[muzimuzhi]

@rhysd BTW you might want to also search for action.yaml files, using filter path:/action\.ya?ml/.

https://github.com/search?q=deprecationMessage+language%3Ayaml+path%3A%2Faction%5C.ya%3Fml%2F&type=code

[webknjaz]

I think if one edits a workflow in GitHub's web interface, it also shows those warnings trying to prevent the outdated use, FTR.