Is there an existing issue for this?
Feature description
GitHub Actions follow docker-like tag pattern, where a new version updates 3 tags simultaneously:
- full version: v1.2.3
- minor version: v1.2
- major version: v1
A common practice then is to use a major version tag (action@v1) to allow automatic minor version drift, and update major versions manually (as that often implies breaking changes)
At the moment, Dependabot is not aware of this convention, and unconditionally suggests the "max" version. This leads to situation when an action updates an action v2 to v3.0.0 example, and that leads to a lot of extraneous PRs after (updating 3.0.0=>3.0.1, 3.0.1=>3.0.2 etc.)
Suggestion: add versioning-strategy value for GitHub actions (e.g. major) which will instruct Dependabot to exclusively use tags where only major version is specified
Is there an existing issue for this?
Feature description
GitHub Actions follow docker-like tag pattern, where a new version updates 3 tags simultaneously:
A common practice then is to use a major version tag (
action@v1) to allow automatic minor version drift, and update major versions manually (as that often implies breaking changes)At the moment, Dependabot is not aware of this convention, and unconditionally suggests the "max" version. This leads to situation when an action updates an action v2 to v3.0.0 example, and that leads to a lot of extraneous PRs after (updating 3.0.0=>3.0.1, 3.0.1=>3.0.2 etc.)
Suggestion: add
versioning-strategyvalue for GitHub actions (e.g.major) which will instruct Dependabot to exclusively use tags where only major version is specified