neilotoole sq-actions-dependabot
Maintainer workflow for Dependabot PRs in the github-actions ecosystem:
version bumps to uses: action pins under
.github/workflows/. For go.mod /
go.sum PRs use
sq-gomod-dependabot; for
site/ Bun/Hugo PRs use
sq-site-dependabot.
Actions are pinned by full commit SHA with a trailing # vX tag comment (for
example docker/login-action@650006c... # v4). Dependabot bumps the SHA and the
comment together; confirm they stay in sync.
No lockfile is involved, so action PRs are loosely coupled. Two PRs can still
conflict when they edit adjacent uses: lines in the same workflow file
(.github/workflows/main.yml holds most
pins), so merge sequentially and @dependabot rebase the next PR after each
squash merge.
Operating modes
| Mode | Actions | Merge |
|---|---|---|
| Audit | List/classify; publisher + bump type | No |
| Validate | Diff review; CI green; actionlint | No |
| Full | Validate + merge with consent | Per PR |
Default to Audit unless the user asks to merge.
Phase 0 — Tool bootstrap
command -v gh >/dev/null && gh auth status
# Optional local workflow lint (CI already runs actionlint in the `lint` job):
# bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
Phase 1 — Discovery
From repository root:
gh pr list --author 'app/dependabot' --state open \
--json number,title,headRefName,headRefOid,mergeable,statusCheckRollup \
--jq '.[] | select(.headRefName | test("^dependabot/github_actions/"))'
Match on headRefName, not the title. Titles such as "bump goreleaser-action"
or "bump golangci-lint-action" trip the gomod skill's word filter but belong
here. Confirm the diff only touches .github/workflows/ (gh pr diff <n> --name-only).
Phase 2 — Risk
| Level | Examples | Action |
|---|---|---|
| Low | Patch/minor bump, first-party publisher (actions/, docker/, golangci/, goreleaser/) |
Merge after CI |
| Medium | Major bump (v4 to v5); action used only in release/publish jobs |
Read changelog; check inputs |
| High | New/untrusted publisher; SHA and # vX comment disagree; non-SHA (tag or branch) pin |
Hold; manual review |
Trusted publishers already in .github/workflows/ carry low supply-chain risk. A
major bump can change or remove with: inputs, so read the release notes and
confirm the workflow still passes the right inputs.
Release-only caveat: PR CI runs the jobs triggered by the pull_request event
(lint, test-nix, test-windows-smoke). Steps and jobs gated to releases or tags
(goreleaser, docker/login, publish, binaries-*) are skipped on the
PR, so green CI does not exercise them. For those, lean on the changelog and
trusted-publisher status.
Phase 3 — Validate
- Required checks green on the current head (
gh pr checks <n>). Thelintjob runsactionlintover the workflow files. - SHA/tag consistency: the new
# vXcomment matches the tag for the bumped SHA. - Optional local lint after installing actionlint:
./actionlint -color. - Stale-head guard: after any
@dependabot rebase, re-check that the required checks passed on the newheadRefOidbefore merging.
Phase 4 — Merge (consent-gated)
After required checks pass on the current head:
gh pr merge <n> --squash --delete-branch
Multiple action PRs: merge one, then @dependabot rebase the next and wait for
mergeable plus fresh CI before merging it. Use --admin only when the user
explicitly requests it and checks are green but merge is blocked.
Verdict template
## Dependabot github-actions PR #NNN — <action>
- **Publisher / bump:** first-party? patch | minor | major
- **Runs on PR CI:** yes | release-only (not exercised)
- **CI (lint/actionlint, test-nix):** pass / fail
- **SHA vs tag comment:** consistent?
- **Verdict:** merge | hold
See AGENTS.md and
docs/CI.md for the CI job map.