dependabot / dependabot/dependabot-core

[Docker] Update docker images declared in `action.yaml` files

Open
#6,892 4 comments 2 reactions 0 assignees View on GitHub
github_actions L: docker T: feature-request T: new-ecosystem
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Feature description

Add option in dependabot to parse docker images declared in `action.yaml` files

Example file

```yml

runs:
using: 'composite'
steps:
- name: Run
shell: bash
run: >
docker run ubuntu@sha256:7a57c69fe1e9d5b97c5fe649849e79f2cfc3bf11d10bbd5218b4eb61716aebe6
```

Contributor guide

Open the contributing guide

Research direction

Start by locating the Docker dependency parser and the action.yaml handling path. Use the provided composite-action example as the input case, then verify that the Ubuntu image digest in a docker run command is detected and can receive updates through Dependabot.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, github-actions
Domain
ci-cd, devops
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.