dependabot / dependabot/dependabot-core

Support for version parameter updates of GHAs

Open
#15,550 0 comments 0 reactions 0 assignees View on GitHub
L: docker L: github:actions L: javascript L: python L: python:uv T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Feature description

There's a category of GitHub Actions whose purpose is installing tools, often with user-configurable versions – see, e.g., [`jdx/mise-action`](https://github.com/jdx/mise-action) or [`astral-sh/setup-uv`](https://github.com/astral-sh/setup-uv). It is good practice to pin the version of the tool to be installed for reproducibility reasons. For example:

```yaml
jobs:
test:
runs-on: ubuntu-24.04
steps:
- ...
- uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
version: 0.11.28
^^^^^^^^^^^^^^^^
- ...
```

To the best of my knowledge, Dependabot offers no way to update the `version: 0.11.28` field because the context of this information is missing.

If we use uv in multiple places, e.g. also in a `Dockerfile` like

```dockerfile
FROM ghcr.io/astral-sh/uv:0.11.28-python3.14-trixie
```

then Dependabot updates the container image tag in the `Dockerfile` but not the version pin in the GHA, resulting in version drift.

[Renovate supports such updates via the `customManagers:githubActionsVersions` manager](https://docs.renovatebot.com/presets-customManagers/#custommanagersgithubactionsversions):

```diff
+env:
+ # renovate: datasource=pypi depName=uv
+ UV_VERSION: 0.11.28

jobs:
test:
runs-on: ubuntu-24.04
steps:
- ...
- uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
- version: 0.11.28
+ version: ${{ env.UV_VERSION }}
- ...
```

A solution to this problem might be the implementation of Renovate's regex manager feature. Something like this was [already proposed](https://github.com/dependabot/feedback/issues/154) but never implemented.

Contributor guide

Open the contributing guide

Research direction

Start with the GitHub Actions and Dockerfile examples in the issue, then review the linked Renovate custom manager documentation and the proposed Dependabot feedback issue. Define how version fields should be identified and updated across these contexts; done means pinned action tool versions can stay synchronized with corresponding image or package versions.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, github-actions
Domain
ci-cd, devops
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.