DEV Community

Cover image for Automatically update GitHub Action versions
Steve Fenton
Steve Fenton

Posted on

Automatically update GitHub Action versions

#github #devops

You don’t notice your GitHub Actions versions until you start getting warnings about things like “Node 20 is no longer supported”. When you think about it, GitHub Actions are yet another dependency that needs to be kept up to date and present supply chain risks.

Get Dependabot to do the work

The good news is, you can get Dependabot to keep your GitHub Actions up to date for you. You can add instructions for this to your .github/dependabot.yml:

version: 2
updates:
  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
Enter fullscreen mode Exit fullscreen mode

In my case I already had configuration for my npm dependencies:

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"
Enter fullscreen mode Exit fullscreen mode

But it’s trivial to add multiple updates to the same file:

version: 2
updates:
  - package-ecosystem: "npm"
    directory: "/"
    schedule:
      interval: "weekly"

  - package-ecosystem: "github-actions"
    directory: "/"
    schedule:
      interval: "weekly"
Enter fullscreen mode Exit fullscreen mode

Automatic pull requests

When you first commit this file, you’ll notice pull requests start appearing for your review.

Dependabot pull request to update a GitHub Action version

- name: Setup pnpm cache
    uses: actions/cache@v4 (-)
    uses: actions/cache@v5 (+)
Enter fullscreen mode Exit fullscreen mode

This is a simple example of how you can use Dependabot to keep your GitHub Actions up to date. You can find more information about Dependabot in the GitHub documentation.

Top comments (0)