Skip to content

Commit f9dd4b4

Browse files
dsotirakisam-stead
andauthored
Update content/code-security/dependabot/ecosystems-supported-by-dependabot/supported-ecosystems-and-repositories.md
Co-authored-by: Anne-Marie <102995847+am-stead@users.noreply.github.com>
1 parent 8e574c6 commit f9dd4b4

1 file changed

Lines changed: 11 additions & 13 deletions

File tree

content/code-security/dependabot/ecosystems-supported-by-dependabot/supported-ecosystems-and-repositories.md

Lines changed: 11 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -45,23 +45,21 @@ If your repository already uses an integration for dependency management, you wi
4545

4646
{% data reusables.dependabot.supported-package-managers %}
4747

48-
### Known issue: Tag format for GitHub Actions in monorepos
48+
## Why does {% data variables.product.prodname_dependabot %} sometimes fail to detect or update {% data variables.product.prodname_actions %} versions in monorepos?
4949

50-
If your repository contains multiple GitHub Actions (for example, in a monorepo), the tag format you use affects how {% data variables.product.prodname_dependabot %} detects and updates action versions.
50+
If your repository contains multiple {% data variables.product.prodname_actions %} (for example, in a monorepo), the tag format you use affects how {% data variables.product.prodname_dependabot %} detects and updates action versions.
5151

52-
- **Dash (-) separator (for example, `@my-action-v0.1.0`):**
52+
- **Dash (`-`) separator** (for example, `@my-action-v0.1.0`):
5353
- {% data variables.product.prodname_dependabot %} may group multiple actions under a single dependency entry or fail to detect new versions correctly. This occurs because {% data variables.product.prodname_dependabot %} relies on slash-based tag parsing to distinguish between actions.
54-
- **Slash (`/`) separator (for example, `@my-action/v0.1.0`):**
54+
- **Slash (`/`) separator** (for example, `@my-action/v0.1.0`):
5555
- {% data variables.product.prodname_dependabot %} correctly detects and updates each action independently, as the slash creates a hierarchical tag structure that aligns with {% data variables.product.prodname_dependabot %}'s parsing logic.
5656

57-
**Example**:
58-
```yaml
59-
# Recommended: namespaced with slash
60-
uses: my-org/monorepo/my-action@my-action/v0.1.0
57+
**Recommendation:** For monorepos with multiple actions, use the `name/version` (slash) format for action tags. This ensures {% data variables.product.prodname_dependabot %} can parse the tag hierarchy correctly and update actions independently.
6158

62-
# Not recommended: dash
63-
uses: my-org/monorepo@my-action-v0.1.0
64-
```
59+
* Example:
60+
```yaml
61+
# Recommended: namespaced with slash
62+
uses: my-org/monorepo/my-action@my-action/v0.1.0
6563

66-
**Recommendation:**
67-
For monorepos with multiple actions, use the `name/version` (slash) format for action tags. This ensures {% data variables.product.prodname_dependabot %} can parse the tag hierarchy correctly and update actions independently.
64+
# Not recommended: dash
65+
uses: my-org/monorepo@my-action-v0.1.0

0 commit comments

Comments
 (0)