Configure Dependabot alerts for when GitHub Actions updates are available

[desrosj]

The GitHub Dependabot can be configured to monitor GitHub Actions for updates. This is useful because it avoids having to manually check every action in use within workflow files.

This should be configured so that maintenance of these workflow files is easier.

[desrosj]

In 52241:

Build/Test Tools: Configure Dependabot scanning for GitHub Actions.

This eliminates the need to manually check all GitHub Actions used within workflow files for updates.

Fixes #54503.

[jrf]

FYI: for anyone who had "old" forks of this repo and have in the mean time updated the default branch in their fork from master to trunk, this config means that PRs will be opened to those forks as well.

As far I can see, there is currently ​no way to disable this for a fork, other than possibly switching to renovate-bot instead.

[desrosj]

Thanks for pointing this out!

I was also surprised to see this happening on my fork. One of the reasons I made this change was that the documentation states that "if you want to enable version updates on forks, there's an extra step" (​source).

It's definitely annoying, but I wonder how many forks of wordpress-develop out of the 1,400 currently are "old" and subject to this. Personally, I would prefer to stick with the native GH Dependabot if possible. If more people start raising this concern, we can open a new ticket to discuss switching. For now, I'll see about reaching out to GitHub DevRel folks and starting a discussion around this one.

[desrosj]

Just wanted to confirm that new forks will have the correct behavior and require them to be manually activated.

[jrf]

Replying to desrosj:

It's definitely annoying, but I wonder how many forks of wordpress-develop out of the 1,400 currently are "old" and subject to this.

Honestly not sure, but AFAICS it only starts happening if they renamed the main branch of their fork to trunk and keep that branch up to date (or at least updated it to beyond the commit which included the Dependabot config).

Personally, I would prefer to stick with the native GH Dependabot if possible.

Understood. Salient detail: Microsoft repos on GH all use Renovate ;-)

If more people start raising this concern, we can open a new ticket to discuss switching. For now, I'll see about reaching out to GitHub DevRel folks and starting a discussion around this one.

👍🏻

Just wanted to confirm that new forks will have the correct behavior and require them to be manually activated.

Yes, IIRC the default behaviour for forks changed about a year ago, but old forks still can't turn it off.

[desrosj]

Replying to jrf:

FYI: for anyone who had "old" forks of this repo and have in the mean time updated the default branch in their fork from master to trunk, this config means that PRs will be opened to those forks as well.

As far I can see, there is currently ​no way to disable this for a fork, other than possibly switching to renovate-bot instead.

To follow up on this, GitHub pushed a feature today that allows more granular control of Dependabot behavior on forks: ​https://github.blog/changelog/2022-11-07-dependabot-pull-requests-off-by-default-for-forks/. I was able to disable Dependabot version updates manually on my fork using this.

[jrf]

Thanks @desrosj ! I've turned it off on my fork now as well. Keeping my fingers crossed it works as advertised ;-)