Thanks @mdtro , this sounds like a good idea. Regarding the pinned versions, will a github bot automatically submit PRs for us to upgrade this tool? Or will we have to monitor that tool to see if there are updates? I don't want to set it and forget it and let it slowly rot.

Thanks @mdtro , this sounds like a good idea. Regarding the pinned versions, will a github bot automatically submit PRs for us to upgrade this tool? Or will we have to monitor that tool to see if there are updates? I don't want to set it and forget it and let it slowly rot.

Dependabot's current configuration on this repo won't update these since we have the SHAs pinned. We would need to enable version updates (instead of just security updates). I can do that in this PR if you'd like. :)

Thanks @mdtro , this sounds like a good idea. Regarding the pinned versions, will a github bot automatically submit PRs for us to upgrade this tool? Or will we have to monitor that tool to see if there are updates? I don't want to set it and forget it and let it slowly rot.

Dependabot's current configuration on this repo won't update these since we have the SHAs pinned. We would need to enable version updates (instead of just security updates). I can do that in this PR if you'd like. :)

@armcknight Scratch that, it looks like Dependabot is already configured here to do version updates on GitHub Actions. So yes, it should be auto-updated. 🎉

@mdtro should we also make sure this is part of the required status checks for merging to main?