Dependency Drift Across Many Repositories
Every project carries a stack of libraries and packages, and each one goes out of date eventually. Left unchecked, outdated dependencies open the door to known vulnerabilities, subtle instability, and performance regressions. For an organization running dozens or hundreds of repositories, manually tracking each dependency's latest release is not realistic.
GitHub's own Open Source Program Office (OSPO) faced exactly this problem internally. Their solution is now public: an Action called Evergreen that acts as a central enforcer for dependency update configuration.
What Dependabot Version Updates Already Do
Dependabot version updates handle the repetitive work of dependency refresh by opening pull requests whenever a new version of a tracked dependency is available. These are distinct from the security-focused Dependabot features: alerts notify you of known vulnerabilities, and security updates automatically raise PRs to patch them. Version updates are broader: they target any outdated dependency, not just ones with a known CVE.
The catch is operational. Dependabot version updates is configured per repository through a YAML file. There is no built-in way for an administrator to roll that configuration out centrally, so settings drift between projects and some repositories get skipped entirely.
Evergreen as a Configuration Watchdog
Evergreen closes that gap. As a GitHub Action, it can run on a schedule or be triggered manually, just like any other workflow (see the docs on triggering workflows). When it runs, it performs a simple audit across every repository in an organization:
- Check: Is Dependabot version updates already configured?
- Configure: If not, Evergreen sets it up automatically.
- Review: It opens a pull request with the proposed configuration so a human can approve before anything takes effect.
The result is a consistent baseline: Dependabot version updates enabled and identically configured everywhere it should be, with no manual YAML edits needed repo by repo. Within GitHub, this process surfaced hundreds of private repositories that had not yet enabled Dependabot; Evergreen continues to run periodically so the organization can keep that coverage current.
Keeping the Baseline Healthy
Dependabot solves the problem of updating dependencies. Evergreen solves the problem of making sure Dependabot is actually switched on everywhere. For teams that manage many repositories, that second step is where the real risk hides. The Evergreen repository has the full setup instructions for anyone wanting to apply the same enforcement across their own organizations.
