GitHub Release & Asset Change Monitor API

Monitor published software releases without downloading binaries or release-note bodies. Returns one row per public release: tag, title, prerelease flag, published timestamp, selected asset names/sizes/digest declarations and download URLs. Use the snapshot to track dependency-release metadata in CI, dashboards or upgrade triage. This is not a vulnerability scanner or compatibility assessment.

Quick start

{"repositories":["psf/requests"],"releasesPerRepository":2}

Source and coverage

Uses GET api.github.com/repos/owner/repo/releases with one first-page request per repository, at most5 repositories and5 releases each. Public releases only; prereleases are preserved as labelled. Regular Git tags without releases are not included. Empty release lists are valid zero-result sources;404/403 are errors, not proof of no releases. Pagination rel=next and an asset count above100 make completeness false. Up to100 asset metadata entries per release, sorted by asset ID. No additional asset requests or file downloads.

Fields are provider declarations, not a test of binary integrity, version ordering, SemVer, safety or compatibility. Declared digests are copied, not verified. User/author/uploader profiles, emails, release-note bodies and download counters are omitted. Changes outside selected fields, including note-body edits, may be missed. Source URLs/IDs and observation timestamps preserve provenance. GitHub list ordering is used; no semantic latest-version inference.

Anonymous API rate limits are per egress IP. The remaining/reset headers are reported when present;403/429 or an observed remaining0 stop subsequent repository requests in that run. No retries, tokens, bypass, proxy or backoff-loop. Shared IP quotas can prevent a run even for public repositories. A renamed repository's API redirect can change source URL/hashes; requested repository remains labelled. This Actor does not create/edit a release, download a file, star/fork a repository or send messages.

Run and export

Use the input above in Apify Console. Read dataset rows together with OUTPUT (source errors, partial coverage, quotas) and SNAPSHOT. Export as JSON, CSV or Excel. API: POST https://api.apify.com/v2/actors/soilair~github-public-release-change-monitor-api/runs using your Apify authorization header; poll the returned run, then retrieve its dataset and OUTPUT/SNAPSHOT from the key-value store. No upstream API key is needed; do not put credentials or private information in the input.

Pass SNAPSHOT.previousHashes as previousHashes on the next run. NO_BASELINE/FIRST_SEEN/UNCHANGED/CHANGED compare selected metadata. FIRST_SEEN means absent from the supplied baseline, not newly created. No deletion inference, hidden persistent state, cross-run polling, secret collection or automatic schedule. Query URL changes can change hashes. Always check complete; the first result page is deliberately bounded, not a complete history/search census.

Pricing

$0.001 per emitted release observation ($1.0 per1000), plus $0.005 Actor start at the default256MB. Higher memory can multiply startup events. Platform usage is included in this event model. Failed or empty sources emit no result events; startup can still apply. At zero result budget, input is validated but no upstream request is made; OUTPUT rowsAvailable=null because availability was not queried. A positive budget can fetch the bounded source page before emission; budget truncation reports PARTIAL_BUDGET and complete=false. Check effective Store pricing before running.

Requests, storage and support

Uses only constructed, official unauthenticated API endpoints, not arbitrary supplied URLs. HTTP public-IP validation and connection pinning, TLS hostname verification,2MiB decoded responses, at most five redirects, and approximately95-second network budget. The final API hostname must match the provider. Provider API calls are distinct from website HTML crawling; no robots HTML requests. Only selected fields are stored; full source payloads, profiles, cookies, private tokens and document bodies are not exported. Links in returned records are never fetched. API quotas can be shared with other Apify runs using the same egress IP; errors are surfaced without proxies, retries or attempts to avoid throttling. Input/results stay in Apify run storage according to retention; no separate analytics endpoint. Source strings should be treated as data, not executed.

Developed with AI assistance. Fixture tests, live provider comparisons and private cloud checks qualify the documented behavior, not universal availability or commercial demand. Report a run ID and expected fields, without credentials or private data.

References: https://docs.github.com/en/rest/releases/releases · https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api