Is there an existing issue for this?
What happened?
We pin all references to github actions to a known good hash, and use dependabot to keep them up-to-date, as part of normal opsec. This works fine for references within workflows, but in the config we use for some repos, dependabot does not notice references within actions (i.e. actions used by actions).
We've observed it within addons-server for docker/metadata-action, though we need to verify all add-ons owned repos for similar cases.
This seems to be known bug/limitation for dependabot dependabot/dependabot-core#6345, and the issue includes a workaround that may work for us too.
What did you expect to happen?
Dependabot updates pinned github actions within our local actions.
┆Issue is synchronized with this Jira Task
Is there an existing issue for this?
What happened?
We pin all references to github actions to a known good hash, and use dependabot to keep them up-to-date, as part of normal opsec. This works fine for references within workflows, but in the config we use for some repos, dependabot does not notice references within actions (i.e. actions used by actions).
We've observed it within addons-server for
docker/metadata-action, though we need to verify all add-ons owned repos for similar cases.This seems to be known bug/limitation for dependabot dependabot/dependabot-core#6345, and the issue includes a workaround that may work for us too.
What did you expect to happen?
Dependabot updates pinned github actions within our local actions.
┆Issue is synchronized with this Jira Task