Dependabot extends version updates to GitHub Actions
GitHub Actions workflows frequently rely on third-party actions that ship regular bug fixes and feature improvements. Previously, keeping those actions current meant manually editing workflow files whenever a new release appeared. In practice, many workflows drifted to outdated action versions. GitHub has now closed that gap: Dependabot version updates can manage the actions referenced in your workflow files automatically, just as they already manage other dependencies.
Dependabot periodically scans your workflow files, checks the actions they use against the latest published releases, and opens pull requests that bump the action references. The update targets the newest release tag (for example, v2), regardless of whether the current reference points to a release tag, a pre-release tag, or a specific commit hash.
Configuration follows the same pattern as other Dependabot version updates. To enable it, commit a dependabot.yml configuration file to your repository. Dependabot version updates are fully configurable, giving you control over the check schedule, assignees for review pull requests, and other update options.
Because the configuration file is shared, the same setup can also manage dependencies for other ecosystems Dependabot supports, including Ruby's bundler and .NET's nuget. Once the file is in place for Actions updates, extending it to cover additional package ecosystems requires no new infrastructure.
