Will It Vibe?Deprecated workflow command
Part of Testing & CI, which counts for 10% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
A run step uses a deprecated stdout workflow command (::set-output, ::save-state, ::set-env, or ::add-path). set-output and save-state are deprecated in favor of the $GITHUB_OUTPUT / $GITHUB_STATE files, and set-env / add-path were disabled for security. These will eventually stop working.
Why it matters
The ::set-output and ::save-state stdout commands are deprecated in favor of the $GITHUB_OUTPUT and $GITHUB_STATE files, and ::set-env and ::add-path were disabled for security. Deprecated commands still work for now but emit warnings and will eventually be removed, at which point the workflow breaks. set-env and add-path are also an injection risk.
How to fix it
Migrate to the environment files: replace echo "::set-output name=key::value" with echo "key=value" >> "$GITHUB_OUTPUT", ::save-state with "$GITHUB_STATE", ::set-env with "$GITHUB_ENV", and ::add-path with "$GITHUB_PATH". These are the supported, non-injectable replacements.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo