dependabot / dependabot/dependabot-core
[Docker] Update docker images declared in `action.yaml` files
- Dominant language
- Ruby
- Stars
- 5.8k
- Forks
- 1.5k
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 149
Description
### Is there an existing issue for this?
- [X] I have searched the existing issues
### Feature description
Add option in dependabot to parse docker images declared in `action.yaml` files
Example file
```yml
runs:
using: 'composite'
steps:
- name: Run
shell: bash
run: >
docker run ubuntu@sha256:7a57c69fe1e9d5b97c5fe649849e79f2cfc3bf11d10bbd5218b4eb61716aebe6
```
Contributor guide
Research direction
Start by locating the Docker dependency parser and the action.yaml handling path. Use the provided composite-action example as the input case, then verify that the Ubuntu image digest in a docker run command is detected and can receive updates through Dependabot.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, github-actions
- Domain
- ci-cd, devops
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100