From 490b5ddd3b7b7df512988ee07dbbfe59d875bc59 Mon Sep 17 00:00:00 2001 From: Trent Blackburn Date: Fri, 28 Aug 2026 16:00:50 -0400 Subject: [PATCH] chore: Enable Dependabot for GitHub Actions Closes #145 with the opposite of what it proposed, deliberately. That issue asked whether to pin actions to immutable commit SHAs. The decision is no. A SHA pin is unreadable without a trailing version comment and needs updating on every action release, which is a permanent cost to a volunteer project. The issue itself already noted that partial pinning buys nothing while the largest surface -- the shared workflow this repository calls -- sits in another repository entirely. Dependabot addresses the same staleness without the readability cost, and it is the prerequisite the issue identified for pinning ever being sustainable. The scope here is small on purpose. This repository's workflows reference only actions/checkout directly; everything else arrives through psake/.github's ModuleCI.yml, which gets its own configuration in psake/.github#11. The shared workflow is referenced by branch rather than by tag, so there is no version here for Dependabot to bump. requirements.psd1 is not covered. Dependabot has no PowerShell Gallery ecosystem, so the PSDepend pins stay manual. Closes #145 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01U1Jhu7fgTRJq7LK5MuKteE --- .github/dependabot.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..ed8033b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,20 @@ +version: 2 +updates: + # This repository's own workflows reference only actions/checkout; everything else + # comes from the shared workflow in psake/.github, which has its own Dependabot + # configuration. The shared workflow is referenced by branch (@main) rather than + # by tag, so there is no version here for Dependabot to bump -- it tracks what + # this repository pins directly. + # + # PSDepend requirements in requirements.psd1 are not covered: Dependabot has no + # PowerShell Gallery ecosystem. + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "weekly" + groups: + github-actions: + patterns: + - "*" + commit-message: + prefix: "ci"