Keep GitHub Actions up to date with GitHub's Dependabot#211
Conversation
* [Keeping your software supply chain secure with Dependabot](https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain) * [Keeping your actions up to date with Dependabot](https://docs.github.com/en/code-security/how-tos/secure-your-supply-chain/secure-your-dependencies/keeping-your-actions-up-to-date-with-dependabot) * [Configuration options for the `dependabot.yml` file - package-ecosystem](https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#package-ecosystem-) To see all GitHub Actions dependencies, type: % `git grep 'uses: ' .github/workflows/`
|
Thanks for your contribution. Dependabot will be added as part of #212. |
|
Today we see more and more supply-chain attacks and npm/pypi packages and GHA actions are the most frequent targets. So, I feel a bit uncomfortable to auto-bump anything in GHA workflow with auto-tools - I like thorough studying of all dependencies and prefer manual bumps. Hope you understand. |
|
Understood. https://nesbitt.io/2026/03/04/package-managers-need-to-cool-down.html cooldown:
default-days: 7 |
|
The addition of Dependabot was rediscussed internally, and we opted not to have it anymore. Dependabot cooldown feature is cool, but yh, a supply chain attack could be more subtle and take months before discovery, who knows? :) The bumping of actions versions will be done manually, as it sounds safer to us. (cooldown = undefined/several-months; attackers can't know when we will bump 😈). 🙂 |
|
OK. Just watch for annotations on GitHub Actions runs that say they are running on EoL versions of Node.js because that is a well documented attack surface. Scroll to the very bottom of:
|
3 participants
dependabot.ymlfile - package-ecosystemTo see all GitHub Actions dependencies, type:
%
git grep 'uses: ' .github/workflows/