World map

 

BM

World 7: Robots: Actions & CI/CD

Dependabot updates

You will learn: how Dependabot keeps your packages and actions up to date.

The problem

Practice repo — not a real website
aina-codes / diary

Monday morning. Two pull requests showed up overnight. You didn’t open them. A robot did. Which one?

Watch

It’s Dependabot: GitHub's helper that warns about unsafe packages and can open pull requests to update them.. Its version updates keep packages fresh, holes or not. You switch them on with one file: .github/dependabot.yml.

Try it

Which line keeps your workflow actions fresh? Tap it.

Tap the line for your workflow actions.

0 of 1 found

Watch

Remember pinned SHAs? Dependabot bumps those too. A pinned action gets a new version. What does Dependabot’s pull request change?

Try it

Security alert (World 8) or version update? Sort each one.

Drag a card into a box. Or tap the card, then tap the box.

      Predict

      A Dependabot pull request makes your CI fail. What now?

      You did it!

      You can now let Dependabot keep your project fresh.

      Go deeper (optional)

      interval can be daily, weekly, monthly and more. Version updates look at your default branch. Lots of small PRs? groups: bundles many updates into one PR. Dependabot’s PRs run your CI, just like a teammate’s.