gh-pr-todo Action

Run gh-pr-todo against a pull request in GitHub Actions. The action downloads the release binary for the current runner, verifies its GitHub-provided SHA-256 digest, caches it by resolved version and platform, and exposes the TODO count and command exit code.

Usage

name: PR TODOs

on:
  pull_request:

permissions:
  contents: read
  pull-requests: read

jobs:
  gh-pr-todo:
    runs-on: ubuntu-latest
    steps:
      - id: todo
        uses: Suree33/gh-pr-todo-action@v1
        with:
          version: v1.1.7
          no-ci-fail: true

      - name: Show TODO count
        run: echo "TODO count: ${{ steps.todo.outputs.todo-count }}"

On pull_request workflows, the action automatically uses github.event.pull_request.number and github.repository. No checkout step is required.

Use a fixed gh-pr-todo version for reproducible results. The action itself should be referenced through the current major tag, such as @v1.

Other Events and Repositories

Provide a PR number, URL, or branch when the event does not contain a pull request:

- id: todo
  uses: Suree33/gh-pr-todo-action@v1
  with:
    repository: Suree33/gh-pr-todo
    pr-number: "147"
    version: v1.1.7

Count Without Failing CI

- id: todo
  uses: Suree33/gh-pr-todo-action@v1
  with:
    version: v1.1.7
    count: true
    no-ci-fail: true

- run: echo "TODO count: ${{ steps.todo.outputs.todo-count }}"

Configure Severity and Ignored Types

Severity values are notice, warning, and error. The value uses the LEVEL=TYPE[,TYPE...] format accepted by gh-pr-todo.

- uses: Suree33/gh-pr-todo-action@v1
  with:
    version: v1.1.7
    group-by: file
    severity: error=FIXME,BUG
    ignore: NOTE,HACK

ignore accepts marker types, not file globs.

Track the Latest Release

Leave version empty to resolve the latest gh-pr-todo release:

- uses: Suree33/gh-pr-todo-action@v1

The resolved release tag is included in the cache key, so a newly published release does not reuse an older latest binary. Pinning a version is still recommended for reproducibility.

Disable Caching

- uses: Suree33/gh-pr-todo-action@v1
  with:
    version: v1.1.7
    cache: false

Inputs

• github-token — Token used by GitHub CLI. Defaults to ${{ github.token }}.
• pr-number — Pull request number, URL, or branch. Defaults to the pull_request event number.
• version — gh-pr-todo release tag, such as v1.1.7. Empty means latest.
• cache — Cache the verified binary by resolved version and platform. Default: true.
• repository — Target repository in OWNER/REPO format. Defaults to the workflow repository.
• group-by — Group results by file or type.
• name-only — Pass --name-only. Default: false.
• count — Pass --count. Default: false.
• severity — Severity assignment such as error=FIXME,BUG.
• ignore — Comma-separated marker types such as NOTE,HACK.
• no-ci-fail — Pass --no-ci-fail. Default: false.
• extra-args — Additional whitespace-separated arguments. Shell quoting inside this string is not interpreted.

Outputs

• todo-count — Number of TODOs reported by gh-pr-todo when available.
• exit-code — Exit code from the primary invocation.
• version — Resolved gh-pr-todo release tag.

Integrity and Platform Support

Every downloaded or restored binary is checked against the SHA-256 digest returned by the GitHub Releases API. A cached binary with the wrong digest is discarded and downloaded again. Execution fails if the release has no valid digest or verification fails.

Tested GitHub-hosted runners:

• ubuntu-latest
• macos-latest
• windows-latest

Matching release assets are also supported on self-hosted Linux (amd64, arm64, arm, 386), macOS (amd64, arm64), and Windows (amd64, arm64, 386) runners.

The runner must provide Bash, GitHub CLI, curl, and either sha256sum or shasum. These are available on the tested GitHub-hosted runners.

License

MIT