# GitHub Release Risk Monitor (`lynchest/tr-github-release-collector`) Actor Track GitHub releases and extract structured risk signals: breaking changes, security fixes, migrations, custom keyword flags, and importance scoring. Built for AI agents, CI/CD pipelines, dependency monitoring, and product research. - **URL**: https://apify.com/lynchest/tr-github-release-collector.md - **Developed by:** [Eren Senses](https://apify.com/lynchest) (community) - **Categories:** Developer tools, AI, Automation - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing Pay per usage This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-usage ## What's an Apify Actor? Actors are a software tools running on the Apify platform, for all kinds of web data extraction and automation use cases. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/platform/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## GitHub Release Risk Monitor [![Apify](https://img.shields.io/badge/Apify-Actor-5B45FF?logo=apify)](https://apify.com) **Track GitHub releases and detect breaking changes, security fixes, migrations, and important keywords — for AI agents, DevOps workflows, dependency monitoring, and product research.** Not a release collector. A **risk signal extractor** that turns raw changelogs into structured, scorable intelligence. > **Intelligence is rule-based, not AI-generated.** Risk flags, keyword matching, and importance scoring use deterministic regex + an additive formula — no LLM calls, no model inference. The `intelligence` input field accepts JSON overrides for custom rules, not prompt configuration. ### Why this exists Raw release data is cheap. **Analyzed, risk-flagged, ready-to-consume signals are premium.** This Actor gives you: - **SemVer classification** — `major` / `minor` / `patch` from tag names - **Breaking change detection** — `BREAKING CHANGE`, `migration required`, `backwards incompatible` - **Security fix detection** — `CVE-*`, `security patch`, `vulnerability` - **Custom keyword flags** — your watchlist, auto-detected in every release - **Importance scoring** — 0–100 rule-based score (breaking+50, security+40, migration+30, major+25, keyword+10 each) - **Only flagged mode** — skip routine patches, emit only what matters - **Stateful monitoring** — cross-run tracking; second run emits zero duplicates - **Rate-limit logging** — reads `X-RateLimit-Remaining` headers, warns on low quota - **Request delay** — configurable ms between repos to smooth traffic ### 🎯 Use Cases #### Monitor dependencies weekly ```json { "repositories": ["vercel/next.js", "nestjs/nest", "microsoft/vscode", "apache/httpd"], "onlyFlagged": true, "outputFormat": "compact", "requestDelayMs": 250 } ```` → Get a clean weekly briefing: what changed, what's risky, what needs migration. #### Find security releases across 50 repos ```json { "repositories": ["expressjs/express", "fastify/fastify", "h5bp/html5-boilerplate"], "onlyFlagged": true, "customKeywords": ["security", "CVE", "vulnerability"], "outputFormat": "compact" } ``` → Security team gets a focused list of releases that need review. #### Feed release signals into AI agents / MCP workflows ```json { "repositories": ["apify/apify-sdk-js", "apify/crawlee", "apify/apify-cli"], "outputFormat": "compact", "sinceDate": "2026-06-01" } ``` → AI agent receives structured release intelligence: `{releaseType, importanceScore, riskFlags, shortSummary}` — no raw markdown to parse. ### ⚙️ Input | Field | Type | Default | Description | |-------|------|---------|-------------| | `repositories` | `string[]` | **required** | `owner/repo` or full GitHub URL | | `token` | `string` (secret) | — | GitHub PAT (5,000 req/h, private repos) | | `maxReleases` | `int` | `10` | Per repo (1–100) | | `includePrereleases` | `bool` | `false` | Include alpha/beta/rc | | `onlyFlagged` | `bool` | `false` | Emit only releases with risk/keyword flags | | `sinceDate` | `string` | — | ISO 8601 start date (e.g. `"2026-07-01"`) | | `customKeywords` | `string[]` | — | Extra keywords to detect | | `requestDelayMs` | `int` | `0` | Delay between repo API calls (ms) | | `outputFormat` | `enum` | `compact` | `compact` or `full` | ### 📦 Output | Field | Type | Example | |-------|------|---------| | `repo` | `string` | `nestjs/nest` | | `tagName` | `string` | `v11.1.27` | | `releaseName` | `string` | `v11.1.27` | | `releaseType` | `enum` | `patch` | | **`importanceScore`** | `int (0–100)` | **`10`** | | **`riskFlags`** | `string[]` | **`["migration"]`** | | **`keywordFlags`** | `string[]` | **`["deprecated"]`** | | `truncatedBody` | `string` | Cleaned first 300 chars | | `publishedAt` | `string` | `2026-06-15T09:17:02Z` | | `isPrerelease` | `bool` | `false` | | `isBotRelease` | `bool` | `false` | | `author` | `string` | `kamilmysliwiec` | | `htmlUrl` | `string` | `https://github.com/...` | | `body` | `string` | *full mode only* | | `repoStars` | `int` | `68400` | | `repoLastCommitDate` | `string` | `2026-07-03T14:22:01Z` | | `repoDefaultBranch` | `string` | `main` | | `rulesetVersion` | `string` | `1.0` | **Bold** = intelligence fields. `isBreaking`/`isSecurityFix` booleans removed — use `riskFlags.includes('breaking-change')` / `riskFlags.includes('security')` instead. Full schema defined in [`.actor/dataset_schema.json`](.actor/dataset_schema.json) with two views: **Signals** (quick triage) and **Full Details**. ### 🧪 Local Development ```bash cd tr-github-release-collector npm install npm run build ## Create local input mkdir -p storage/key_value_stores/default cat > storage/key_value_stores/default/INPUT.json << 'EOF' {"repositories":["nestjs/nest"],"maxReleases":3,"onlyFlagged":false} EOF ## Run APIFY_LOCAL_STORAGE_DIR=./storage npm start ## Second run — stateful, no duplicate output APIFY_LOCAL_STORAGE_DIR=./storage npm start ## View output cat storage/datasets/default/000000001.json ``` #### Resetting state Delete the state file to reset all tracking: ```bash rm -f storage/GITHUB_RELEASE_MONITOR_STATE.json ``` Or on the Apify platform, clear the default key-value store. ### 🚀 Deploy ```bash apify login apify push ``` ### ⚠️ Rate Limits **Unauthenticated** GitHub API usage is limited to **60 requests/hour**.\ This Actor makes **2 API calls per repository per run** (one for releases, one for repo metadata), so monitoring **~25 repositories** in a single run will exhaust the free quota. - **For monitoring more than ~25 repos per run**, provide a GitHub token via the `token` input field (raises limit to 5,000 req/h, enough for ~2,500 repos). - The `requestDelayMs` option helps avoid bursty requests, but does **not** increase the hourly GitHub API quota. - The Actor logs `X-RateLimit-Remaining` headers on every API call and warns when quota is low. ### 🔍 Intelligence Details #### Importance Score Additive rule-based formula, **capped to \[0, 100]** via `Math.max(0, Math.min(100, score))`: | Signal | Weight | |--------|--------| | Baseline | 10 | | `breaking-change` flag | +50 | | `security` flag | +40 | | `migration` flag | +30 | | `major` SemVer | +25 | | `minor` SemVer | +5 | | Each custom keyword match | +10 each | | Prerelease | −15 | Overflow example: breaking(50) + security(40) + major(25) = 115 → capped to **100**.\ Calibration: 100 = multi-risk critical release. Single minor patches score ~0. #### State / Dedup Cross-run dedup compares `publishedAt` timestamps. A release seen in a previous run is skipped. > ⚠️ **If a maintainer edits a release body after publication** (e.g. adds CVE details later), the Actor **will not reprocess it** — the timestamp doesn't change. For critical dependencies, periodically reset the state file (see [Local Development](#-local-development)). #### Custom Keywords Matching is **case-insensitive substring**. Example: `"security"` matches `"Security"`, `"securityContext"`, `"cybersecurity"`. Use specific phrases like `"security fix"`, `"CVE-2024"` to reduce false positives. ### 🧱 Stack - Node.js 22 + TypeScript - Apify SDK 3.7 - GitHub REST API (no scraping libs) - File-based state persistence ### 📄 License MIT # Actor input Schema ## `repositories` (type: `array`): GitHub repositories to monitor. Use "owner/repo" format (e.g. "vercel/next.js") or full GitHub URL. ## `token` (type: `string`): Optional GitHub PAT. Increases rate limit from 60 to 5,000 req/h and enables private repo access. ## `maxReleases` (type: `integer`): Maximum number of latest releases to fetch per repository. ## `includePrereleases` (type: `boolean`): Include prereleases (alpha, beta, rc) in the results. ## `intelligence` (type: `object`): JSON object overriding default intelligence logic: risk flags, importance thresholds, keyword matching rules, and model-based classification. Leave empty to use built-in defaults. ## `onlyFlagged` (type: `boolean`): Only emit releases that have risk flags (breaking, security, migration) or keyword matches. Quiet releases are still tracked in state but excluded from output. ## `sinceDate` (type: `string`): Only process releases published on or after this date (ISO 8601, e.g. "2026-07-01"). Useful for controlled first-run start dates. ## `customKeywords` (type: `array`): Extra keywords/phrases to flag in release notes (case-insensitive). ## `requestDelayMs` (type: `integer`): Delay between GitHub API calls per repo (milliseconds). Use 250–500 for large repo lists to avoid rate limiting without a token. ## `outputFormat` (type: `string`): Select output verbosity. Compact includes intelligence fields + summary without release body; Full includes the complete release body text. ## Actor input object example ```json { "repositories": [ "vercel/next.js", "nestjs/nest", "microsoft/vscode" ], "maxReleases": 10, "includePrereleases": false, "onlyFlagged": false, "customKeywords": [ "migration", "deprecated", "removed", "requires" ], "requestDelayMs": 0, "outputFormat": "compact" } ``` # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "repositories": [ "vercel/next.js", "nestjs/nest", "microsoft/vscode" ], "customKeywords": [ "migration", "deprecated", "removed", "requires" ] }; // Run the Actor and wait for it to finish const run = await client.actor("lynchest/tr-github-release-collector").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "repositories": [ "vercel/next.js", "nestjs/nest", "microsoft/vscode", ], "customKeywords": [ "migration", "deprecated", "removed", "requires", ], } # Run the Actor and wait for it to finish run = client.actor("lynchest/tr-github-release-collector").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "repositories": [ "vercel/next.js", "nestjs/nest", "microsoft/vscode" ], "customKeywords": [ "migration", "deprecated", "removed", "requires" ] }' | apify call lynchest/tr-github-release-collector --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=lynchest/tr-github-release-collector", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "GitHub Release Risk Monitor", "description": "Track GitHub releases and extract structured risk signals: breaking changes, security fixes, migrations, custom keyword flags, and importance scoring. Built for AI agents, CI/CD pipelines, dependency monitoring, and product research.", "version": "0.3", "x-build-id": "oJpgFeLwvwaqQ0tpk" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/lynchest~tr-github-release-collector/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-lynchest-tr-github-release-collector", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/lynchest~tr-github-release-collector/runs": { "post": { "operationId": "runs-sync-lynchest-tr-github-release-collector", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/lynchest~tr-github-release-collector/run-sync": { "post": { "operationId": "run-sync-lynchest-tr-github-release-collector", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "repositories" ], "properties": { "repositories": { "title": "Repositories", "type": "array", "description": "GitHub repositories to monitor. Use \"owner/repo\" format (e.g. \"vercel/next.js\") or full GitHub URL.", "items": { "type": "string" } }, "token": { "title": "GitHub Token", "type": "string", "description": "Optional GitHub PAT. Increases rate limit from 60 to 5,000 req/h and enables private repo access." }, "maxReleases": { "title": "Max Releases Per Repo", "minimum": 1, "maximum": 100, "type": "integer", "description": "Maximum number of latest releases to fetch per repository.", "default": 10 }, "includePrereleases": { "title": "Include Prereleases", "type": "boolean", "description": "Include prereleases (alpha, beta, rc) in the results.", "default": false }, "intelligence": { "title": "Intelligence Settings", "type": "object", "description": "JSON object overriding default intelligence logic: risk flags, importance thresholds, keyword matching rules, and model-based classification. Leave empty to use built-in defaults." }, "onlyFlagged": { "title": "Only Flagged Releases", "type": "boolean", "description": "Only emit releases that have risk flags (breaking, security, migration) or keyword matches. Quiet releases are still tracked in state but excluded from output.", "default": false }, "sinceDate": { "title": "Since Date", "type": "string", "description": "Only process releases published on or after this date (ISO 8601, e.g. \"2026-07-01\"). Useful for controlled first-run start dates." }, "customKeywords": { "title": "Custom Keywords", "type": "array", "description": "Extra keywords/phrases to flag in release notes (case-insensitive).", "items": { "type": "string" } }, "requestDelayMs": { "title": "Request Delay (ms)", "minimum": 0, "maximum": 10000, "type": "integer", "description": "Delay between GitHub API calls per repo (milliseconds). Use 250–500 for large repo lists to avoid rate limiting without a token.", "default": 0 }, "outputFormat": { "title": "Output Format", "enum": [ "compact", "full" ], "type": "string", "description": "Select output verbosity. Compact includes intelligence fields + summary without release body; Full includes the complete release body text.", "default": "compact" } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```