Skip to content

chore(dependabot): monitor local composite actions - #2899

Merged
gcl-sekoia merged 1 commit into
mainfrom
gha-security/harden-local-actions
Aug 7, 2026
Merged

chore(dependabot): monitor local composite actions#2899
gcl-sekoia merged 1 commit into
mainfrom
gha-security/harden-local-actions

Conversation

@gcl-sekoia

Copy link
Copy Markdown
Contributor

Summary

  • Switch the github-actions Dependabot entry from directory to directories and add /.github/actions/*
  • This ensures dependencies in .github/actions/delete-preview/action.yaml are tracked for version and security updates
  • Follow-up to ci: Harden GitHub Actions workflows #2877 which hardened the workflows but missed covering the local composite action in Dependabot

Test plan

  • Verify Dependabot picks up the new directories and creates PRs for outdated actions in .github/actions/

@github-actions

github-actions Bot commented Mar 26, 2026

Copy link
Copy Markdown

Pull request was merged, preview was removed.

@github-actions

Copy link
Copy Markdown

This PR was marked as stale because it has been open for 30 days with no activity.

@github-actions github-actions Bot added the stale label Apr 26, 2026
@alexane-bougeardbebin-sekoia

Copy link
Copy Markdown
Contributor

@gcl-sekoia can you follow-up on this PR please? should we merge? close?

@gcl-sekoia

Copy link
Copy Markdown
Contributor Author

@alexane-bougeardbebin-sekoia The general idea of this PR is something we should do. I'll check the specifics later today and update the PR.

Add `/.github/actions/*` to the github-actions Dependabot directories
so that dependencies in `.github/actions/delete-preview/action.yaml`
are tracked for version and security updates.
@gcl-sekoia
gcl-sekoia force-pushed the gha-security/harden-local-actions branch from a357d98 to 3476407 Compare August 7, 2026 11:08
@gcl-sekoia gcl-sekoia removed the stale label Aug 7, 2026
@gcl-sekoia
gcl-sekoia marked this pull request as ready for review August 7, 2026 11:13
@gcl-sekoia
gcl-sekoia requested a lite review from Copilot August 7, 2026 11:13

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the repository’s Dependabot configuration so GitHub Actions dependencies are monitored not only in workflows, but also inside local composite actions under .github/actions/.

Changes:

  • Switch the github-actions Dependabot configuration from a single directory to multiple directories.
  • Add an additional path intended to cover local composite actions under .github/actions/.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread .github/dependabot.yml
@gcl-sekoia
gcl-sekoia enabled auto-merge August 7, 2026 11:46
@gcl-sekoia

Copy link
Copy Markdown
Contributor Author

@alexane-bougeardbebin-sekoia Ready to merge!

@gcl-sekoia
gcl-sekoia merged commit ed7bb37 into main Aug 7, 2026
3 checks passed
@gcl-sekoia
gcl-sekoia deleted the gha-security/harden-local-actions branch August 7, 2026 12:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants