Keeping pinned GitHub Actions up to date

After pinning our GitHub Actions to commit hashes, my biggest worry was that they'd never get updated again. An audit tool tells me about known problems, but I also want an easy way to continually bump these actions forward.

GitHub's built-in Dependabot can do that part quite well. It runs in the background, and when it finds a potential update, it opens a pull request that updates the hash and the version comment together.

# .github/dependabot.yml
version: 2

updates:
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: weekly
    cooldown:
      default-days: 7
    groups:
      actions:
        patterns:
          - actions/*
      docker:
        patterns:
          - docker/*

Let's walk through a few things I tweaked in this config.

First, I have it run on a weekly interval, but also set a "cooldown" period of 7 days. This period means it won't suggest an update newer than 7 days. The idea behind this is that any supply chain attack would hopefully be caught by then, so I could avoid installing any newly-vulnerable versions.

Next, I decided to group updates by publisher in two chunks. I use a number of first-party GitHub actions which all have the actions/ prefix, and I also use a bunch from the official Docker repo.

Sometimes there will be a flurry of updates across a publisher, so by grouping them, I get one pull request to review for all actions from each publisher, instead of one per action.

I use other actions from smaller publishers, all of which are ungrouped and would get their own pull request and a closer look.

With this tool in place, my worry about pinned actions going stale is no longer a concern.

Here to help,

Joel

P.S. Working through a change like this is more fun with other people who care about the details. Come compare notes with the Laravel developers in our community.