Add Dependabot for GitHub Actions - #823
Merged
Merged
Conversation
The workflows here are pinned to commit SHAs, which is the right call, but nothing keeps the pins current: setup-uv sits at v5.4.2 while ord-data and ord-schema run v7, and actions/checkout is behind even within its own v4 major. Dependabot understands SHA-pinned actions and rewrites the SHA together with its trailing version comment, so the pins keep their security property without freezing. Grouped monthly to keep it to one pull request. Expect a first round of catch-up pull requests once this lands. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The workflows here are pinned to commit SHAs, which is the right call — mutable version tags are what made the
tj-actions/changed-filescompromise so wide, and SHA pinning is what protected the repositories that had it. But nothing keeps those pins current, and the drift is already measurable:astral-sh/setup-uvsits at v5.4.2 while ord-data and ord-schema run v7, andactions/checkoutis behind even within its own v4 major.Dependabot understands SHA-pinned actions and rewrites the SHA together with its trailing
# vNcomment, so the pins keep their security property without freezing. That is the missing half of the pattern this repository already adopted.Updates are grouped so this arrives as one pull request a month rather than one per action. Expect a first round of catch-up pull requests once this lands — that backlog is the point.
Part of an org-wide sweep: ord-schema#910, ord-data#264, and ord-interface#214 add the same config alongside the SHA pins those repositories were missing.
🤖 Generated with Claude Code
Greptile Summary
Adds Dependabot configuration for GitHub Actions.
Confidence Score: 5/5
The PR appears safe to merge with no actionable issues identified.
The configuration uses the correct GitHub Actions ecosystem, repository-root directory, required schedule fields, and wildcard grouping to cover the existing SHA-pinned workflow actions.
Important Files Changed
Reviews (1): Last reviewed commit: "Add Dependabot for GitHub Actions" | Re-trigger Greptile