dependabot / dependabot/dependabot-core
Bump `docker` image references in GitHub Actions workflow
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
Instead of running github workflows or gitlab-ci on a :latest docker image, using fixed versions provides better stability.
It would therefore be awesome if dependabot could create pull requests with a bumped (but not :latest) image for a ci-setup.
I guess getting the versions of docker images from dockerhub is already implemented for the "docker" mode which bumps Dockerfiles.
Cheers
APN
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the existing Docker mode that retrieves image versions from Docker Hub, then find how GitHub Actions workflows and ci-setup images are handled. Done means Dependabot can create pull requests that replace :latest Docker image references with fixed versions without changing other workflow behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, github-actions
- Domain
- ci-cd, devops
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100