dependabot / dependabot/dependabot-core
Local actions in .github/actions/ are not checked
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 155
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Package ecosystem
github-actions
### Package manager version
_No response_
### Language version
_No response_
### Manifest location and content before the Dependabot update
_No response_
### dependabot.yml content
version: 2
updates:
- package-ecosystem: "github-actions"
directory: "/"
schedule:
interval: "weekly"
### Updated dependency
_No response_
### What you expected to see, versus what you actually saw
When directory is set to `"/"`, I expect that local actions located in `.github/actions/` are also checked.
This is not the case.
You need to add a new item in the config file to allow Dependabot to check a specific action
```
- package-ecosystem: "github-actions"
directory: "/.github/actions/deployment-tools"
schedule:
interval: "weekly"
```
### Native package manager behavior
_No response_
### Images of the diff or a link to the PR, issue, or logs
_No response_
### Smallest manifest that reproduces the issue
_No response_
Contributor guide
Research direction
Reproduce the issue with the shown dependabot.yml configuration and a local action under .github/actions/deployment-tools. Trace GitHub Actions dependency discovery to determine why directory "/" omits local actions, then verify that the root configuration checks them without requiring a separate directory entry.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions
- Domain
- ci-cd
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100