dependabot / dependabot/dependabot-core
Support for version parameter updates of GHAs
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Feature description
There's a category of GitHub Actions whose purpose is installing tools, often with user-configurable versions – see, e.g., [`jdx/mise-action`](https://github.com/jdx/mise-action) or [`astral-sh/setup-uv`](https://github.com/astral-sh/setup-uv). It is good practice to pin the version of the tool to be installed for reproducibility reasons. For example:
```yaml
jobs:
test:
runs-on: ubuntu-24.04
steps:
- ...
- uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
version: 0.11.28
^^^^^^^^^^^^^^^^
- ...
```
To the best of my knowledge, Dependabot offers no way to update the `version: 0.11.28` field because the context of this information is missing.
If we use uv in multiple places, e.g. also in a `Dockerfile` like
```dockerfile
FROM ghcr.io/astral-sh/uv:0.11.28-python3.14-trixie
```
then Dependabot updates the container image tag in the `Dockerfile` but not the version pin in the GHA, resulting in version drift.
[Renovate supports such updates via the `customManagers:githubActionsVersions` manager](https://docs.renovatebot.com/presets-customManagers/#custommanagersgithubactionsversions):
```diff
+env:
+ # renovate: datasource=pypi depName=uv
+ UV_VERSION: 0.11.28
jobs:
test:
runs-on: ubuntu-24.04
steps:
- ...
- uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
with:
- version: 0.11.28
+ version: ${{ env.UV_VERSION }}
- ...
```
A solution to this problem might be the implementation of Renovate's regex manager feature. Something like this was [already proposed](https://github.com/dependabot/feedback/issues/154) but never implemented.
Contributor guide
Research direction
Start with the GitHub Actions and Dockerfile examples in the issue, then review the linked Renovate custom manager documentation and the proposed Dependabot feedback issue. Define how version fields should be identified and updated across these contexts; done means pinned action tool versions can stay synchronized with corresponding image or package versions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, github-actions
- Domain
- ci-cd, devops
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100