News for hackers. Stuff that matters.

A comment on The Pain That Is GitHub Actions. Parent comment

Re:The Pain That Is GitHub Actions by StrLght on Thursday March 20, 2025 @04:13AM (#43420744)
You don’t have to update them manually. Renovate supports pinned GitHub Actions dependencies [1]. Unfortunately, I don’t use Dependabot so can’t say whether it does the same.

Just make sure you don’t leak secrets to your PRs. Also I usually review changes in updated actions before merging them. It doesn’t take that much time, so far I’ve been perfectly fine with doing that.

[1]: https://docs.renovatebot.com/modules/manager/github-actions/...

[ Parent | on HN ]
Re:The Pain That Is GitHub Actions by chuckadams on Thursday March 20, 2025 @07:52AM (#43421909)
Dependabot does support pinned hashes, even adds the comment after them with the tag. Dependabot fatigue is a thing though, and blindly mashing "merge" doesn't do much for your security, but at least there's some delay between a compromise and your workflow being updated to include it.
[ Parent | on HN ]