dependabot / dependabot/dependabot-core

Local actions in .github/actions/ are not checked

Open
#6,345 12 comments 21 reactions 0 assignees View on GitHub
L: github:actions T: bug 🐞 T: feature-request
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
155

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

github-actions

### Package manager version

_No response_

### Language version

_No response_

### Manifest location and content before the Dependabot update

_No response_

### dependabot.yml content

version: 2

updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"

### Updated dependency

_No response_

### What you expected to see, versus what you actually saw

When directory is set to `"/"`, I expect that local actions located in `.github/actions/` are also checked.

This is not the case.

You need to add a new item in the config file to allow Dependabot to check a specific action

```
- package-ecosystem: "github-actions"
directory: "/.github/actions/deployment-tools"
schedule:
interval: "weekly"
```

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Reproduce the issue with the shown dependabot.yml configuration and a local action under .github/actions/deployment-tools. Trace GitHub Actions dependency discovery to determine why directory "/" omits local actions, then verify that the root configuration checks them without requiring a separate directory entry.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions
Domain
ci-cd
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.