Dependabot alerts expand to GitHub Actions

GitHub is extending its Dependabot alerting to cover vulnerable GitHub Actions. The change means repositories using Actions will now receive automated notifications when a workflow dependency has a known security issue, with the alerts backed by the GitHub Advisory Database.

For teams already running Dependabot, no configuration changes are needed. The new Action alerts arrive alongside existing dependency alerts. Users who haven't yet enabled Dependabot can do so via the "Enable all" option under the Code security and analysis settings on GitHub.

Screenshot showing how a user can receive alerts on GitHub Actions and vulnerabilities impacting their code

The alert workflow mirrors Dependabot's existing behavior for package dependencies: when GitHub's security researchers document a vulnerability in an action, an advisory is published in the GitHub Advisory Database, and impacted repositories are automatically notified. Advisory data remains searchable and free to use.

Reporting a vulnerable Action

Action maintainers who discover a security flaw in their own project can file a repository security advisory from the security tab of their GitHub repository. Once the advisory is tagged as belonging to the GitHub Actions ecosystem, GitHub's curation team reviews it and, when appropriate, publishes a global advisory that triggers alerts across affected repositories.

For smooth processing, GitHub asks maintainers submitting Action advisories to confirm the following:

  1. The Action uses semantic versioning.
  2. The submitter owns the repository for the Action in question.
  3. Package names follow the org-name/repo-name format, such as GitHub/GitHub's-favorite-action.
  4. The repository contains only one Action, so it can be clearly distinguished from others.

Security context

The move strengthens the connection between GitHub's supply chain security tooling and its CI/CD platform. GitHub positions this as part of a broader effort to harden build infrastructure, noting that teams can layer Action-level restrictions at the enterprise level alongside Dependabot alerts to control which actions are permitted in their environments.

Screenshot of the GitHub Actions "Getting Started" page

The GitHub Advisory Database, which powers these alerts, publishes vulnerability data under a Creative Commons license and has done so since launch. Alongside Dependabot alerts and security updates, the database feeds GitHub's broader supply chain security capabilities. Teams looking for details can consult GitHub's documentation on managing vulnerable dependencies or browse the database itself.